{
  "type": "URL",
  "indicator": "https://test.mccune.ca",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://test.mccune.ca",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3752672048,
      "indicator": "https://test.mccune.ca",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 50,
      "pulses": [
        {
          "id": "6958780c8479a9d69920c3d8",
          "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack",
          "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD  forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.",
          "modified": "2026-02-02T01:02:46.327000",
          "created": "2026-01-03T01:59:40.530000",
          "tags": [
            "united",
            "moved",
            "title",
            "passive dns",
            "ipv4 add",
            "urls",
            "files",
            "hosting",
            "reverse dns",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender mar",
            "read c",
            "create c",
            "medium",
            "search",
            "memcommit",
            "high",
            "checks",
            "windows",
            "execution",
            "dock",
            "write",
            "persistence",
            "capture",
            "local",
            "ref b",
            "wed may",
            "backdoor",
            "mtb aug",
            "next associated",
            "mtb dec",
            "twitter",
            "smoke loader",
            "malware",
            "virtool",
            "hacktool",
            "data upload",
            "present dec",
            "mtb apr",
            "win32",
            "trojan",
            "worm",
            "lowfi",
            "cybota",
            "expiration date",
            "name servers",
            "ipv4",
            "url analysis",
            "port",
            "destination",
            "telnet login",
            "bad login",
            "gpl telnet",
            "suspicious path",
            "busybox",
            "tcp syn",
            "et telnet",
            "path",
            "mirai",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "america",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "learn",
            "t1179 hooking",
            "installs",
            "t1035 service",
            "adversaries",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "y013",
            "flag",
            "span",
            "accept",
            "core",
            "february",
            "hybrid",
            "malicious",
            "general",
            "click",
            "strings",
            "roboto",
            "next",
            "usa windows",
            "finished",
            "queueprogress",
            "timestamp input",
            "threat level",
            "october",
            "september",
            "hwp support",
            "fresh",
            "win64",
            "khtml",
            "gecko",
            "brand",
            "microsoft edge",
            "programfiles",
            "comspec",
            "model",
            "iframe",
            "form",
            "listeners",
            "initial access",
            "t1590 gather",
            "victim network",
            "ssl certificate",
            "quasi government",
            "jeffrey reimer",
            "palantir",
            "Regis university",
            "otx hp",
            "apple",
            "pegasus",
            "h5 data center",
            "florence colorado",
            "brian sabey",
            "target : Tsara Brasheaers",
            "aig",
            "industry and commerce",
            "united states",
            "State of Colorado.",
            "date",
            "status",
            "domain",
            "hostname add",
            "pulse pulses",
            "files ip",
            "address",
            "url https",
            "url http",
            "hostname",
            "show",
            "type indicator",
            "source hostname",
            "entries",
            "Prometheus Intelligence Technology",
            "pulse submit",
            "america flag",
            "body",
            "dynamicloader",
            "microsoft azure",
            "tls issuing",
            "named pipe",
            "json",
            "ascii text",
            "lredmond",
            "Apple",
            "Telnet",
            "BusyBox",
            "Pegasus",
            "Colorado State Fixer: Christopher P. Ahmann",
            "Hijacker: Brian Sabey",
            "For: Concentra",
            "Protecting Assaulter: Jeffrey Reimer",
            "For: AIG",
            "For Industry and Commerce",
            "For: Quasi Government",
            "For: Workers Compensation",
            "Authorities",
            "Law Enforcement Dark",
            "Silencing",
            "Tampering with a Victim",
            "Meta",
            "Palantir",
            "Google",
            "Bing",
            "Microsoft",
            "ColoCrossing",
            "Associates",
            "hit men"
          ],
          "references": [
            "ET Telnet |  https://www.colocrossing.com | velocity servers",
            "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
            "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
            "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
            "(legitimate services will remain up-and-running usually) High |  ID dead_host",
            "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
            "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
            "Yara Detections is__elf",
            "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
            "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
            "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
            "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
            "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
            "https://www.colocrossing.com/",
            "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
            "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
            "104.21.51.140, 172.67.181.41",
            "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
            "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
            "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
            "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
            "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
            "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
            "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
            "This is hard to comprehend or put into indelible words."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Unix.Trojan.DarkNexus-7679166-0",
              "display_name": "Unix.Trojan.DarkNexus-7679166-0",
              "target": null
            },
            {
              "id": "HackTool:MSIL/Boilod.C!bit",
              "display_name": "HackTool:MSIL/Boilod.C!bit",
              "target": "/malware/HackTool:MSIL/Boilod.C!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1098",
              "name": "Account Manipulation",
              "display_name": "T1098 - Account Manipulation"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1462",
              "name": "Malicious Software Development Tools",
              "display_name": "T1462 - Malicious Software Development Tools"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Technology",
            "Healthcare",
            "Insurance",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6390,
            "domain": 723,
            "hostname": 1978,
            "FileHash-SHA256": 1912,
            "FileHash-MD5": 410,
            "FileHash-SHA1": 306,
            "email": 3,
            "SSLCertFingerprint": 28,
            "CVE": 3
          },
          "indicator_count": 11753,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "76 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68feb98a8c1b75b4431a3e8e",
          "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
          "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
          "modified": "2025-11-25T20:05:31.749000",
          "created": "2025-10-27T00:15:06.191000",
          "tags": [
            "html internet",
            "html document",
            "ascii text",
            "language",
            "cve202323397",
            "iframe tags",
            "tag manager",
            "gtmkvjvztk",
            "anchor hrefs",
            "info ta0011",
            "protocol",
            "layer protocol",
            "port",
            "t1571 encrypted",
            "channel",
            "t1573 malware",
            "tree",
            "oc0006 http",
            "c0014",
            "get http",
            "dns resolutions",
            "resolved ips",
            "user",
            "data",
            "datacrashpad",
            "edge",
            "v full",
            "reports v",
            "chrome u",
            "appdata local",
            "googlechrome u",
            "u ser",
            "cname",
            "ip address",
            "http",
            "accept",
            "network dropped",
            "duration cuckoo",
            "version file",
            "machine label",
            "shutdown",
            "extraction",
            "suggested iocs",
            "data upload",
            "cry dee",
            "stop",
            "type",
            "url indicator",
            "enter",
            "failed",
            "se share",
            "extrac",
            "enter so",
            "passive dns",
            "urls",
            "hostname add",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as20473",
            "dynamicloader",
            "directui",
            "write c",
            "intel",
            "ms windows",
            "pe32",
            "element",
            "delete c",
            "document file",
            "v2 document",
            "explorer",
            "trojandropper",
            "write",
            "markus",
            "august",
            "movie",
            "insert",
            "pulse submit",
            "url analysis",
            "asn as8068",
            "united",
            "entries",
            "body",
            "please",
            "x msedge",
            "ipv4 add",
            "present sep",
            "present oct",
            "present feb",
            "status",
            "unknown ns",
            "search",
            "name servers",
            "present jul",
            "aaaa",
            "present apr",
            "trojan",
            "medium",
            "high",
            "yara rule",
            "globalc",
            "june",
            "malware",
            "win64",
            "unknown",
            "america flag",
            "twitter",
            "hostname",
            "domain add",
            "reverse dns",
            "america asn",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "unknown aaaa",
            "title",
            "meta",
            "window",
            "encrypt",
            "pulse indicator",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "atlanta",
            "abuse",
            "agent",
            "service",
            "present jun",
            "present may",
            "creation date",
            "record value",
            "servers",
            "libretv meta",
            "certificate",
            "value",
            "whois lookup",
            "loopia ab",
            "userlolxxl"
          ],
          "references": [
            "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
            "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
            "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
            "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
            "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
            "https://hs.ecam.com/your-challenges-ecams-solutions",
            "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
            "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
            "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            },
            {
              "id": "Foundry",
              "display_name": "Foundry",
              "target": null
            },
            {
              "id": "Trojan:Win32/Comisproc!gmb",
              "display_name": "Trojan:Win32/Comisproc!gmb",
              "target": "/malware/Trojan:Win32/Comisproc!gmb"
            },
            {
              "id": "Trojandropper:Win32/VB.IL",
              "display_name": "Trojandropper:Win32/VB.IL",
              "target": "/malware/Trojandropper:Win32/VB.IL"
            },
            {
              "id": "#Exploit:Win32/CVE- 2023 - 23397",
              "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
              "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "ALF:PulZati:Worm:Win32/Mydoom",
              "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 8,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 248,
            "FileHash-SHA1": 134,
            "FileHash-SHA256": 2661,
            "URL": 6257,
            "domain": 682,
            "email": 8,
            "hostname": 2077,
            "CVE": 1
          },
          "indicator_count": 12068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "145 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fd0cc422cea2fd989581fd",
          "name": "LevelBlue - Open Threat Exchange (Malicious Attacks)",
          "description": "I\u2019ll\nrefer to these bad actors as the .lol .fun group. London, Australia , South Africa with US base External resources. With this group, you e probably met though attackers.. OTX errors! Difficult to pulse. There are some profiles in here that are shady and attempt or do co connect to your products. They usually begin social engineering by saying that you have a \u2018problem\u2019 just like they do. Say they are from Canada or\nFrance , somewhere abroad when they are down the street using your services. There was user \u2018Merkd\u2019 whose entire system seem to become infected by someone or someone about this platform. Check the IP address at all\nTo see if it matches or is on the same block as OTC, region will show as well. Hackers may potentially cnc / move your profile on their own block. What happened today was weird. Alien Vault became a PHP and turned bright pink and black, requesting I download page. Keep your systems locked down if you\u2019re researching not reporting vulnerabilities.",
          "modified": "2025-11-24T17:02:12.441000",
          "created": "2025-10-25T17:45:40.291000",
          "tags": [
            "ipv4",
            "levelblue",
            "open threat",
            "date sat",
            "connection",
            "etag w",
            "cloudfront",
            "sameorigin age",
            "vary",
            "ip address",
            "kb body",
            "gtmkvjvztk",
            "utc gcfezl5ynvb",
            "utc na",
            "utc google",
            "analytics na",
            "utc linkedin",
            "insight tag",
            "learn",
            "exchange og",
            "levelblue open",
            "threat exchange",
            "exchange",
            "google tag",
            "iocs",
            "search otx",
            "included iocs",
            "review iocs",
            "data upload",
            "extraction",
            "layer protocol",
            "v full",
            "reports v",
            "port t1571",
            "t1573",
            "oc0006 http",
            "c0014",
            "get http",
            "dns resolutions",
            "user",
            "data",
            "datacrashpad",
            "edge",
            "tag manager",
            "us er",
            "help files",
            "shell",
            "html",
            "cve202323397",
            "iframe tags",
            "community score",
            "url http",
            "url https",
            "united",
            "united kingdom",
            "netherlands",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "indicator role",
            "title added",
            "active related",
            "otc oct",
            "report spam",
            "week ago",
            "scan",
            "learn more",
            "filehashmd5",
            "filehashsha1",
            "domain",
            "australia",
            "does",
            "josh",
            "created",
            "filehashsha256",
            "present jul",
            "present oct",
            "date",
            "a domains",
            "script urls",
            "for privacy",
            "moved",
            "script domains",
            "meta",
            "title",
            "body",
            "pragma",
            "encrypt",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1027",
            "files",
            "information",
            "t1055",
            "injection",
            "capture",
            "south korea",
            "malaysia",
            "pulses",
            "fatal error",
            "hacker known",
            "name",
            "unknown",
            "risk",
            "weeks ago",
            "scary",
            "sova",
            "colorado",
            "wire",
            "name unknown",
            "thursday",
            "denver",
            "types of",
            "indicators hong",
            "kong",
            "tsara brashears",
            "african",
            "ethiopia",
            "b8reactjs",
            "india",
            "america",
            "x ua",
            "hostname",
            "dicator role",
            "pulses url",
            "airplane",
            "icator role",
            "t1432",
            "access contact",
            "list",
            "t1525",
            "image",
            "security scan",
            "heuristic oct",
            "discovery",
            "t1069",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1114",
            "t1480",
            "internal image",
            "brian sabey",
            "month ago",
            "modified",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "t1040",
            "sniffing",
            "t1045",
            "packing",
            "t1053",
            "taskjob"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Sova",
              "display_name": "Sova",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1022",
              "name": "Data Encrypted",
              "display_name": "T1022 - Data Encrypted"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1525",
              "name": "Implant Internal Image",
              "display_name": "T1525 - Implant Internal Image"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 956,
            "FileHash-SHA1": 906,
            "FileHash-SHA256": 2651,
            "URL": 4450,
            "domain": 708,
            "hostname": 2403,
            "CVE": 1,
            "email": 5
          },
          "indicator_count": 12080,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68abf66e97031d0ff0c04fed",
          "name": "Packed sentient.industries links to a targets business website",
          "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
          "modified": "2025-09-24T04:04:05.604000",
          "created": "2025-08-25T05:36:46.327000",
          "tags": [
            "moved",
            "body",
            "x cache",
            "cloudfront x",
            "cph50 c2",
            "certificate",
            "record value",
            "title",
            "h1 center",
            "server",
            "redacted for",
            "servers",
            "name redacted",
            "for privacy",
            "name servers",
            "org data",
            "privacy city",
            "privacy country",
            "ca creation",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "asn as57033",
            "less whois",
            "registrar",
            "tucows domains",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl ecc",
            "domain secure",
            "site ca",
            "validity",
            "subject public",
            "extraction",
            "data upload",
            "extra data",
            "include review",
            "find",
            "failed",
            "typ no",
            "ms windows",
            "intel",
            "pe32",
            "united",
            "search",
            "as16509",
            "from win32bios",
            "show",
            "high",
            "medium",
            "delphi",
            "copy",
            "write",
            "launcher",
            "next",
            "present aug",
            "present jul",
            "lowfi",
            "win32",
            "a div",
            "div div",
            "learn xml",
            "babylon",
            "win64",
            "trojan",
            "colors",
            "python",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "et info",
            "tls handshake",
            "bad traffic",
            "failure",
            "date",
            "august",
            "hybrid",
            "general",
            "path",
            "starfield",
            "click",
            "strings",
            "se bethseda",
            "n bethseda",
            "n data",
            "error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results aug",
            "read c",
            "tlsv1",
            "port",
            "destination",
            "module load",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "cname",
            "aaaa",
            "creation date",
            "showing",
            "domain",
            "dga domains",
            "palantirfoundry",
            "foundry",
            "status",
            "unknown ns",
            "g2 tls",
            "rsa sha256",
            "italy unknown",
            "mtb may",
            "trojandropper",
            "invalid url",
            "next associated",
            "ddos",
            "body html",
            "hacktool",
            "ipv4",
            "url analysis",
            "ukraine",
            "encrypt",
            "rl add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present jun",
            "entries",
            "title error",
            "all ipv4",
            "reverse dns",
            "yara detections",
            "top source",
            "top destination",
            "source source",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "canada unknown",
            "content type",
            "javascript src",
            "script script",
            "x powered",
            "ipv4 add",
            "pulse submit",
            "submit url",
            "analysis",
            "url add",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "unknown aaaa",
            "ascii text",
            "user agent",
            "powershell",
            "agent",
            "czechia unknown",
            "domain add",
            "dynamicloader",
            "hostname add",
            "pentagon",
            "defense"
          ],
          "references": [
            "sentient.industries affects independent artists. Affects several others.",
            "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
            "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
            "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
            "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
            "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
            "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
            "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
            "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
            "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
            "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
            "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
            "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
            "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
            "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
            "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
            "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
            "https://link.monetizer101.com/widget/code/dailystaruk.js",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
            "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
            "(Can't access file- Malware infection files)",
            "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
            "constellation.pcfrpegaservice.net (Pegasus related? idk)",
            "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
            "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
            "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
            "Remotewd.com devices",
            "If you find anything interesting please research it."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "nUFS_inno",
              "display_name": "nUFS_inno",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious",
              "target": null
            },
            {
              "id": "ALF:JASYP:PUA:Win32/Bibado",
              "display_name": "ALF:JASYP:PUA:Win32/Bibado",
              "target": null
            },
            {
              "id": "Trojan:Win32/Toga",
              "display_name": "Trojan:Win32/Toga",
              "target": "/malware/Trojan:Win32/Toga"
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-149",
              "display_name": "Win.Trojan.Jorik-149",
              "target": null
            },
            {
              "id": "#LowFiDetectsVmWare",
              "display_name": "#LowFiDetectsVmWare",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-130",
              "display_name": "Win.Trojan.Jorik-130",
              "target": null
            },
            {
              "id": "Win.Trojan.Fakecodecs-119",
              "display_name": "Win.Trojan.Fakecodecs-119",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Bulz-9860169-0",
              "display_name": "Win.Trojan.Bulz-9860169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop.V!MTB",
              "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
              "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Win.Packed.Razy-9785185-0",
              "display_name": "Win.Packed.Razy-9785185-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "PWS",
              "display_name": "PWS",
              "target": null
            },
            {
              "id": "DDOS:Win32/Stormser.A",
              "display_name": "DDOS:Win32/Stormser.A",
              "target": "/malware/DDOS:Win32/Stormser.A"
            },
            {
              "id": "ALF:HSTR:DotNET",
              "display_name": "ALF:HSTR:DotNET",
              "target": null
            },
            {
              "id": "DotNET",
              "display_name": "DotNET",
              "target": null
            },
            {
              "id": "Script Exploit",
              "display_name": "Script Exploit",
              "target": null
            },
            {
              "id": "HackTool:Win32/AutoKMS",
              "display_name": "HackTool:Win32/AutoKMS",
              "target": "/malware/HackTool:Win32/AutoKMS"
            },
            {
              "id": "Xanfpezes.A",
              "display_name": "Xanfpezes.A",
              "target": null
            },
            {
              "id": "Trojan:Win32/Gandcrab",
              "display_name": "Trojan:Win32/Gandcrab",
              "target": "/malware/Trojan:Win32/Gandcrab"
            },
            {
              "id": "Win.Trojan.Generic-9862772-0",
              "display_name": "Win.Trojan.Generic-9862772-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBL!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
            },
            {
              "id": "Win32/Nemucod",
              "display_name": "Win32/Nemucod",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "target": null
            },
            {
              "id": "Trojan:Win32/Blihan.A",
              "display_name": "Trojan:Win32/Blihan.A",
              "target": "/malware/Trojan:Win32/Blihan.A"
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "Win.Malware.Kolab-9885903-0",
              "display_name": "Win.Malware.Kolab-9885903-0",
              "target": null
            },
            {
              "id": "Win.Malware (30)",
              "display_name": "Win.Malware (30)",
              "target": null
            },
            {
              "id": "Ransom",
              "display_name": "Ransom",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "target": null
            },
            {
              "id": "E5",
              "display_name": "E5",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 6232,
            "URL": 24908,
            "hostname": 7993,
            "FileHash-SHA256": 11128,
            "email": 6,
            "FileHash-MD5": 1054,
            "FileHash-SHA1": 932,
            "SSLCertFingerprint": 14,
            "CIDR": 3,
            "CVE": 3
          },
          "indicator_count": 52273,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "207 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68923ea4efbf58b7ba48acec",
          "name": "Hosted App",
          "description": "",
          "modified": "2025-09-04T16:03:17.037000",
          "created": "2025-08-05T17:25:56.454000",
          "tags": [
            "issuer wr3",
            "log id",
            "gmtn",
            "abn timestamp",
            "ad180b80",
            "full name",
            "extensionsstr",
            "web server",
            "ca issuers",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "mitre att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "show technique",
            "date",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "flag",
            "usa windows",
            "hwp support",
            "march",
            "december",
            "united",
            "markmonitor",
            "overview dns",
            "requests domain",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "t1179 hooking",
            "access windows",
            "installs",
            "control att",
            "found",
            "development att",
            "name server",
            "show process",
            "programfiles",
            "command decode",
            "suricata ipv4",
            "ck matrix",
            "comspec",
            "model",
            "general",
            "dynamicloader",
            "unknown",
            "as16509",
            "whitelisted",
            "medium",
            "write c",
            "as15169",
            "search",
            "high",
            "write",
            "android",
            "malware",
            "copy",
            "next",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "site",
            "neue",
            "ipv4",
            "pulse pulses",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "refer",
            "present dec",
            "epub",
            "present jan",
            "present nov",
            "present oct",
            "showing",
            "urls show",
            "win32",
            "win64",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "prefetch8",
            "localappdata",
            "prefetch1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3409,
            "hostname": 4127,
            "URL": 8408,
            "SSLCertFingerprint": 9,
            "FileHash-SHA256": 1175,
            "FileHash-MD5": 144,
            "FileHash-SHA1": 134,
            "CVE": 2
          },
          "indicator_count": 17408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68596260a9ca6c4cc92ca068",
          "name": "Delete service | Affects Threat Research Platforms",
          "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
          "modified": "2025-08-20T04:13:22.641000",
          "created": "2025-06-23T14:19:12.328000",
          "tags": [
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "oc0006",
            "get http",
            "resolved ips",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ip address",
            "country name",
            "cname",
            "port",
            "accept",
            "gmt ifnonematch",
            "url data",
            "icmp",
            "mutexes nothing",
            "data",
            "datacrashpad",
            "edge",
            "created",
            "nothing",
            "html internet",
            "html document",
            "ascii text",
            "gtmkvjvztk dl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2401,
            "URL": 5856,
            "FileHash-SHA256": 3473,
            "domain": 2188,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 120,
            "CVE": 2
          },
          "indicator_count": 14163,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18de7177474b759ab2b7",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:10.608000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18d829739be014393c59",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:04.872000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6875e98438889e51b3fdd18f",
          "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch",
          "description": "",
          "modified": "2025-08-14T05:04:16.839000",
          "created": "2025-07-15T05:39:16.652000",
          "tags": [
            "win32 exe",
            "country",
            "include review",
            "exclude",
            "defense evasion",
            "access ta0006",
            "command",
            "control ta0011",
            "impact ta0040",
            "impact ob0008",
            "file system",
            "system oc0008",
            "match unknown",
            "adversaries",
            "match info",
            "info",
            "execution flow",
            "t1574 dll",
            "tries",
            "registry",
            "modify system",
            "process t1543",
            "unknown",
            "window",
            "ob0009 install",
            "ob0012 install",
            "insecure",
            "b0047 modify",
            "registry e1112",
            "hidden files",
            "registry run",
            "keys",
            "startup folder",
            "f0012 file",
            "critical",
            "united",
            "as15169",
            "delete c",
            "as16509",
            "show",
            "search",
            "intel",
            "ms windows",
            "entries",
            "medium",
            "worm",
            "copy",
            "write",
            "explorer",
            "malware",
            "next",
            "present jul",
            "status",
            "date",
            "ip address",
            "domain",
            "servers",
            "showing",
            "unknown ns",
            "related pulses",
            "pulses",
            "tags",
            "related tags",
            "more file",
            "type",
            "date april",
            "am size",
            "sha1 sha256",
            "as14618",
            "united kingdom",
            "as54113",
            "as15133 verizon",
            "top source",
            "top destination",
            "status domain",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "source source",
            "oamazon",
            "cnamazon rsa",
            "odigicert inc",
            "sweden as20940",
            "as20940",
            "entries tls",
            "ip destination",
            "encrypt",
            "aaaa",
            "found",
            "certificate",
            "next associated",
            "urls show",
            "date checked",
            "error",
            "windows",
            "high",
            "yara detections",
            "installs",
            "checks",
            "filehash",
            "sha256 add",
            "themida",
            "data upload",
            "extraction",
            "md5 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "win32",
            "ddos",
            "passive dns",
            "activity",
            "checkin",
            "win64",
            "mtb jan",
            "lowfi",
            "trojan",
            "ransom",
            "trojandropper",
            "yara",
            "nsis",
            "nss bv",
            "su data",
            "windo alerts",
            "andariel",
            "malware traffic",
            "nids",
            "icmp traffic",
            "dns query",
            "id deadhost",
            "connects",
            "andariel high",
            "richhash",
            "external",
            "virustotal api",
            "screenshots",
            "failed",
            "auurtonany data",
            "themida andarie",
            "present may",
            "japan unknown",
            "unknown cname",
            "domain add",
            "urls",
            "files",
            "http headers",
            "msie",
            "windows nt",
            "tcp syn",
            "resolverror",
            "externalport",
            "internalport",
            "wget command",
            "devices home",
            "execution",
            "foundry",
            "home networks",
            "mirai",
            "x.com",
            "porn",
            "monitored target",
            "d link",
            "targets"
          ],
          "references": [
            "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
            "Crowdsourced Signa: Schedule system process by Joe Security",
            "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
            "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
            "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
            "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
            "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
            "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
            "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
            "*Themida_2xx. Oreans,Technologies",
            "*Andariel Backdoor Activity (Checkin)",
            "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
            "IDS: WGET Command Specifying Output in HTTP Headers",
            "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
            "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
            "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
            "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
            "Devices remotely connected, tracked , monitored"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Unix.Trojan.Mirai-6981169-0",
              "display_name": "Unix.Trojan.Mirai-6981169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Ursu-9856871-0",
              "display_name": "Win.Malware.Ursu-9856871-0",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 448,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 5851,
            "hostname": 2580,
            "domain": 1176,
            "URL": 7133,
            "SSLCertFingerprint": 30,
            "email": 3,
            "CVE": 3
          },
          "indicator_count": 17659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a93360163e8802e213158",
          "name": "ELF:Mirai AMAZON-02 - Autonomous System  65.0.0.0/14",
          "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features",
          "modified": "2025-07-12T07:04:05.635000",
          "created": "2025-06-12T08:43:34.719000",
          "tags": [
            "thumbprint",
            "apnic",
            "apnic whois",
            "database",
            "please",
            "arin whois",
            "north america",
            "caribbean",
            "africa",
            "internet",
            "iana",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "algorithm",
            "v3 serial",
            "number",
            "cbe oglobalsign",
            "r6 alphassl",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "link",
            "search",
            "united",
            "a domains",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "india unknown",
            "status",
            "passive dns",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "location india",
            "india asn",
            "as133296 web",
            "dns resolutions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 27,
            "domain": 2499,
            "hostname": 2651,
            "URL": 10986,
            "CIDR": 2,
            "FileHash-SHA256": 3596,
            "email": 1,
            "FileHash-MD5": 23,
            "CVE": 7
          },
          "indicator_count": 19792,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "281 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a3719a2708183b1b16d00",
          "name": "Follow Bot (black-basta_cova_cryptb) affects threat researcher(s)account(s)",
          "description": "Surprised: \nFollow bot account  affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. \n\n\n(00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | =\nfollow) \n|| {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer\nFastCopy5.9.0.exe}\n\nET DNS Query for .cc \n PROTOCOL-ICMP PATH MTU denial of service attempt\nPROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set",
          "modified": "2025-07-12T01:02:11.925000",
          "created": "2025-06-12T02:10:33.839000",
          "tags": [
            "gtmkvjvztk",
            "open threat",
            "learn",
            "levelblue",
            "exchange meta",
            "tags twitter",
            "alienvault",
            "script tags",
            "iframe tags",
            "google tag",
            "html internet",
            "html document",
            "ascii text",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "number",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "cus subject",
            "stwa lredmond",
            "omicrosoft c",
            "resolved ips",
            "get http",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "defense evasion",
            "ta0009 command",
            "impact ta0040",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "ob0007 impact",
            "ob0012 file",
            "system oc0001",
            "process oc0003",
            "data oc0004",
            "oc0008",
            "get https",
            "vis1",
            "oid2",
            "post https",
            "cjutxg",
            "base64uidenc",
            "error https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 162,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2459,
            "domain": 889,
            "hostname": 1217,
            "URL": 4326,
            "FilePath": 1
          },
          "indicator_count": 9082,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "281 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6615d6998eba463f36adf923",
          "name": "hxxps://viz[.]greynoise[.]io/analysis/22fe6389-fe4a-49dc-b343-b6a2feb32864 - 04.04.24 by jwanihad (enriched)",
          "description": "",
          "modified": "2025-06-23T17:53:11.641000",
          "created": "2024-04-10T00:00:25.617000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/gui/collection/789999053bd7022e2d79a887a5f959be573ce57d6c4f3165503438fbd5dd9ad5/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2361,
            "domain": 632,
            "FileHash-SHA256": 644,
            "hostname": 918
          },
          "indicator_count": 4555,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "300 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "676de64bb6892336196cfeb9",
          "name": "http://www.home.pl/  xn--gwna-qqa78b.pl ( g\u0142\u00f3wna.pl )",
          "description": "Wersja j\u0105dra maszyny wirtualnej\t6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)\nThe following is a full list of text and images from the 2016 European Union (EU) conference, held in Berlin, Germany, which were held on Tuesday, 1 July 2016, at 19:00 BST.",
          "modified": "2025-05-14T21:15:08.161000",
          "created": "2024-12-26T23:27:06.044000",
          "tags": [
            "jak zmieni",
            "panelu klienta",
            "zmiana hasa",
            "strong",
            "obsuga poczty",
            "w tym",
            "za porednictwem",
            "panelu",
            "certyfikaty ssl",
            "kalendarz pracy",
            "jest",
            "facebook",
            "ciebie",
            "zamw teraz",
            "zobacz szczegy",
            "zobacz",
            "office",
            "chc wystartowa",
            "google",
            "zastanawiasz si",
            "zrobisz",
            "otrzymasz pomoc",
            "android",
            "pdf regulamin",
            "zacznik",
            "wiadczenia",
            "regulaminu usug",
            "usug",
            "regulaminy",
            "link regulamin",
            "regulamin usugi",
            "poczta",
            "teamviewer",
            "anydesk",
            "microsoft",
            "vps linux",
            "vps windows",
            "kreator www",
            "standard",
            "start",
            "premium",
            "asseco",
            "cennik",
            "starter",
            "twitch",
            "core",
            "ultimate",
            "defender",
            "enterprise",
            "solo",
            "import",
            "designer",
            "strona",
            "czsto zadawane",
            "status polityka",
            "polityka plikw",
            "poland",
            "germany",
            "lukow",
            "frankfurt am",
            "united",
            "warszawa",
            "ip location",
            "osint verdict",
            "katowice",
            "koeln porz",
            "main",
            "polska",
            "niemcy",
            "frankfurt",
            "menem",
            "szczecin",
            "san francisco",
            "kolonia porz",
            "szczecin strona",
            "n ty",
            "m mi",
            "a ty",
            "c mi",
            "h mi",
            "d mi",
            "span",
            "ihdr",
            "vu phys",
            "srgb",
            "gama aidatxp",
            "adobe xmp",
            "adobe photoshop",
            "windows",
            "dte6f7",
            "rfzt85drbqj2n",
            "ud0 c",
            "rjxrj2ooy",
            "gwnj",
            "sosj im",
            "donex",
            "sha256",
            "sha1",
            "june",
            "copyright",
            "doscom sha256",
            "dosexe",
            "http request",
            "method get",
            "country a",
            "polandpoland as",
            "name",
            "number",
            "protocol h3",
            "type",
            "mime type",
            "data size",
            "identyfikator",
            "https dane",
            "v3 numer",
            "odcisk palca",
            "wystawca",
            "us cn",
            "encrypt wano",
            "nie wczeniej",
            "nie po",
            "informacje"
          ],
          "references": [
            "https://pomoc.home.pl/faq/5",
            "http://www.home.pl./",
            "http://www.home.pl/",
            "https://home.pl/regulaminy",
            "https://home.pl/cennik",
            "https://www.home.pl/regulaminy",
            "https://home.pl/login"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 19,
            "FileHash-SHA256": 615,
            "CIDR": 1,
            "domain": 243,
            "URL": 1520,
            "hostname": 413,
            "email": 1,
            "FileHash-MD5": 26,
            "IPv4": 32,
            "YARA": 1
          },
          "indicator_count": 2871,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "340 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "414 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6523344e4adc85389899504c",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2024-10-13T03:00:28.081000",
          "created": "2023-10-08T22:59:26.040000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b48d699080b4bfd334c5",
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7761,
            "CVE": 6,
            "FileHash-MD5": 285,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 5059,
            "domain": 987,
            "hostname": 2399
          },
          "indicator_count": 16662,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "553 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fee4dec993692315eb9e9",
          "name": "NjRAT | Threat Network | https://www.poemhunter.com/tsara-brashears  ",
          "description": "",
          "modified": "2024-09-05T07:13:57.083000",
          "created": "2023-12-18T07:01:33.682000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fed19f6d24e751fa82de8",
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2775,
            "URL": 7125,
            "domain": 1726,
            "hostname": 2417
          },
          "indicator_count": 14348,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6695e27f356a22d97fba5ca8",
          "name": "Critical attack/s continues to affect YouTube Creator/s account/s",
          "description": "Related to YouTube creator/s  attack/s. Found as part of Jays Youtube Bot.exe and YouTube bots.\nFull CnC, access and id devices. Redirects views, resells. spoofs, binds and/or accounts. FRAUD! \nReference: YARA Signature Match - THOR APT Scanner\nRULE: SUSP_Wextract_Anomaly_Unsigned_May23\nRULE_SET: Livehunt - Suspicious290 Indicators \ud83c\udff9\nRULE_TYPE: THOR APT Scanner's rule set only \ud83d\udd28\nRULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_Wextract_Anomaly_Unsigned_May23\nDESCRIPTION: Detects an anomalous unsigned wextract that contains additional code and has been seen abused to deliver malware\nREFERENCE: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution/\nRULE_AUTHOR: X__Junior\nThor for details #susp_wextract_anomaly_unsigned_may23",
          "modified": "2024-08-15T02:00:24.886000",
          "created": "2024-07-16T03:01:17.316000",
          "tags": [
            "win32 exe",
            "wextract",
            "kb file",
            "files",
            "file type",
            "javascript",
            "graph",
            "ip detections",
            "country",
            "userprofile",
            "runtime modules",
            "samplepath",
            "delnoderundll32",
            "mpgph131 hr",
            "hourly rl",
            "highest c",
            "mpgph131 lg",
            "onlogon rl",
            "highest",
            "process",
            "registrya",
            "registry keys",
            "registry",
            "windows policy",
            "shell folders",
            "file execution",
            "binary data",
            "security center",
            "text c",
            "peexe c",
            "xml c",
            "zip c",
            "file system",
            "written c",
            "dropped",
            "hashes",
            "windows nt",
            "wow64",
            "referer https",
            "date thu",
            "get https",
            "request",
            "gecko response",
            "gmt connection",
            "gmt vary",
            "etag",
            "accept",
            "win64",
            "query",
            "windows get",
            "internal",
            "set file",
            "create",
            "create process",
            "windows read",
            "shutdown system",
            "modify access",
            "delete registry",
            "enumerate",
            "behavior tags",
            "k0pmbc",
            "spsfsb",
            "ctsu",
            "efq78c",
            "egw7od",
            "en3i8d",
            "i6ydgd",
            "iz1fbc",
            "izt63",
            "kum7z",
            "vs2003",
            "sp1 build",
            "contained",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "simplified",
            "army",
            "variant sides",
            "with russia",
            "ramnit",
            "netsupport rat",
            "sneaky server",
            "replacement",
            "unauthorized",
            "sim unlock",
            "emotet",
            "chaos",
            "malicious",
            "critical",
            "copy",
            "life",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "cc linker",
            "urls",
            "gandi sas",
            "domains",
            "cloudflare",
            "ii llc",
            "psiusa",
            "domain robot",
            "ltd dba",
            "com laude",
            "ascio",
            "contacted",
            "ms word",
            "document",
            "b file",
            "html",
            "javascript jac",
            "html iu3",
            "executed by usa",
            "#wextract",
            "#unsigned",
            "thor",
            "stealer",
            "evader",
            "systemroot",
            "grum",
            "high",
            "delete c",
            "cape",
            "write",
            "103 read",
            "clsid read",
            "date read",
            "trojan",
            "united",
            "unknown",
            "status",
            "cname",
            "creation date",
            "search",
            "as1921",
            "austria unknown",
            "emails",
            "expiration date",
            "date",
            "pragma",
            "next",
            "passive dns",
            "backdoor",
            "win32",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "usa",
            "co",
            "teams",
            "cybercrime",
            "spoof",
            "benjamin",
            "dynamicloader",
            "write c",
            "pe32 executable",
            "show",
            "yara rule",
            "windows",
            "recon",
            "worm",
            "powershell",
            "june",
            "delphi",
            "malware",
            "malice",
            "retaliation",
            "through the nights",
            "apple",
            "lenovo",
            "ios",
            "hackers",
            "move",
            "moved"
          ],
          "references": [
            "WEXTRACT.EXE .MUI: FileHash-SHA256 00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4",
            "MALWARE STEALER TROJAN EVADER | WEXTRACT.EXE .MUI | TXTRESSE | via https://www.virustotal.com/gui/domain/www.youtube.com",
            "CS Sigma: Matches rule Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke",
            "Critical CS Sigma: Matches rule Suspicious Double Extension File Execution by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)",
            "^ by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) ^",
            "CS Sigma: Matches rule Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, J\u00e1n Tren\u010dansk\u00fd, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan",
            "CS Sigma: Matches rule Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)",
            "CS Sigma: Matches rule Suspicious Add Scheduled Task Parent by Florian Roth (Nextron Systems)",
            "CS Sigma: Matches rule Suspicious Schtasks Schedule Type With High Privileges by Nasreddine Bencherchali (Nextron Systems)",
            "CS Sigma: Matches rule Scheduled Task Creation by Florian Roth (Nextron Systems)",
            "CS IDS: Matches rule (stream_tcp) data sent on stream not accepting data",
            "CS IDS: Matches rule (http_inspect) HTTP response has UTF character set that failed to normalize",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration)",
            "CS IDS: Matches rule ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)",
            "CS IDS: Matches rule ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token)  Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP)",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Activity)",
            "CS IDS: Matches rule ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent",
            "CS IDS: Matches rule ET MALWARE Suspected RisePro TCP Heartbeat Packet",
            "CS IDS: Matches rule ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)",
            "CS IDS: Matches rule ET MALWARE Win32/Ramnit Checkin Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "TXTRESSE: FileHash-SHA256 00001dd58b69582cc30a16b000bce3d96d369487444385489084719676afba4d",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "Crowdsourced YARA rules: Matches rule win_ramnit_auto from ruleset win.ramnit_auto by Felix Bilstein - yara-signator at cocacoding dot com",
            "Crowdsourced YARA rules: Matches rule MAL_Ramnit_May19_1 from ruleset crime_nansh0u by Florian Roth (Nextron Systems)",
            "Crowdsourced IDS rules: Matches rule: MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "Crowdsourced IDS rules: Matches rule: (port_scan) UDP filtered",
            "Crowdsourced IDS rules: Matches rule: ET MALWARE Win32/Ramnit Checkin | Matches rule ET DNS Query for .cc TLD",
            "https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "TrojanDownloader:Win32/Upatre ,  Virus:Win32/Sality.AT , Win.Downloader.Small-1645",
            "Antivirus Detections: Backdoor:Win32/Likseput.B ,  PWS:Win32/QQpass.B!MTB ,  Trojan:Win32/Scrarev.C ,  Trojan:Win32/Speesipro.A ,  Trojan:Win32/Zombie.A ,  TrojanDownloader:Win32/Cutwail.BS ,  TrojanDownloader:Win32/Nemucod ,",
            "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Backdoor.Win32.Pushdo.s Checkin Suspicious csrss.exe in URI",
            "https://www.virustotal.com/gui/file/00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4/detection",
            "Jays Youtube Bot.exe > FileHash-SHA256 00514527e00ee001d042",
            "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2",
            "https://www.youtube.com/watch?v=GyuMozsVyYs",
            "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"",
            "https://otx.alienvault.com/pulse/6694bb9be1b61bf820500004",
            "http://193.233.132.62/hera/amadka.exe | https://www.info-only-men.com/landing/mlp88g?subPublisher=popunder:eu-adsrv.rtbsuperhub.com&zone=popunder:eu-adsrv.rtbsuperhub.com&",
            "https://software-free-phone-2018.win/62ae8f9b-d0cb-4b4c-8318-dd7900e1d092/e29481e9-a792-46a8-bbf0-188ed2a816ae/?brand=Apple&browser=Safari&btd=dHJr",
            "nr-data.net [Apple Private Data Collection]",
            "https://rector-fitiology.icu/99c8d3a6-be16-421a-87a8-40701eae8149?zoneid=6543079&bannerid=18710758&browser=chrome&os=ios&devic",
            "https://software-free-phone-2018.win/7a7c1101-0538-49de-925f-4f4675a5fd1f/3b0669f6-a07e-4eb8-8e2b-d0282d482c1a/?brand=Lenovo&browser=Chr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WAT:Blacked-E",
              "display_name": "WAT:Blacked-E",
              "target": null
            },
            {
              "id": "Win32:RmnDrp [Inf]",
              "display_name": "Win32:RmnDrp [Inf]",
              "target": null
            },
            {
              "id": "AI:FileInfector.EAEEA7850C",
              "display_name": "AI:FileInfector.EAEEA7850C",
              "target": null
            },
            {
              "id": "Virus.Ramnit/Nimnul",
              "display_name": "Virus.Ramnit/Nimnul",
              "target": null
            },
            {
              "id": "Trojan.Crifi.1",
              "display_name": "Trojan.Crifi.1",
              "target": null
            },
            {
              "id": "Trojan.MSIL.Injurer.cbd",
              "display_name": "Trojan.MSIL.Injurer.cbd",
              "target": null
            },
            {
              "id": "Win.Downloader.Small-1645",
              "display_name": "Win.Downloader.Small-1645",
              "target": null
            },
            {
              "id": "Trojan:Win32/Scrarev.C",
              "display_name": "Trojan:Win32/Scrarev.C",
              "target": "/malware/Trojan:Win32/Scrarev.C"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Trojan:Win32/Speesipro.A",
              "display_name": "Trojan:Win32/Speesipro.A",
              "target": "/malware/Trojan:Win32/Speesipro.A"
            },
            {
              "id": "Virus:Win32/Sality.AT",
              "display_name": "Virus:Win32/Sality.AT",
              "target": "/malware/Virus:Win32/Sality.AT"
            },
            {
              "id": "TrojanDownloader:Win32/Upatre",
              "display_name": "TrojanDownloader:Win32/Upatre",
              "target": "/malware/TrojanDownloader:Win32/Upatre"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail.BS",
              "display_name": "TrojanDownloader:Win32/Cutwail.BS",
              "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Backdoor:Win32/Likseput.B",
              "display_name": "Backdoor:Win32/Likseput.B",
              "target": "/malware/Backdoor:Win32/Likseput.B"
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
              "display_name": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003.007",
              "name": "Proc Filesystem",
              "display_name": "T1003.007 - Proc Filesystem"
            },
            {
              "id": "T1042",
              "name": "Change Default File Association",
              "display_name": "T1042 - Change Default File Association"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Media",
            "Technology",
            "Civil Society",
            "Crime Victims"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4312,
            "domain": 1056,
            "hostname": 1818,
            "URL": 5125,
            "FileHash-MD5": 310,
            "FileHash-SHA1": 221,
            "email": 3
          },
          "indicator_count": 12845,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "612 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980ad16123b5d52f5f76f",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
          "description": "",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-19T12:10:21.291000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65f4ba867ec44a4dc0e6fc96",
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 235,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f4ba867ec44a4dc0e6fc96",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
          "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-15T21:15:50.802000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eada25525805ad74c32b54",
          "name": "(Cloned from OTX user)  OTX pulses modified and deleted by ???",
          "description": "",
          "modified": "2024-04-06T11:00:59.869000",
          "created": "2024-03-08T09:28:05.923000",
          "tags": [
            "referrer",
            "execution",
            "dropped",
            "apple ios",
            "contacted",
            "partru",
            "sneaky server",
            "replacement",
            "unauthorized",
            "emotet",
            "submission",
            "alienvault",
            "open threat",
            "learn",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "google tag",
            "gtmkvjvztk",
            "anchor hrefs",
            "urls",
            "domains",
            "registrar",
            "ltd dba",
            "com laude",
            "markmonitor",
            "ip detections",
            "country",
            "graph",
            "hashes cape",
            "sandbox",
            "zenbox",
            "files c",
            "filesgoogle c",
            "written c",
            "extensions",
            "process",
            "created",
            "processes tree",
            "hour ago",
            "scan endpoints",
            "all scoreblue",
            "report spam",
            "modified",
            "scan",
            "iocs",
            "learn more",
            "hostname",
            "filehashsha256",
            "next",
            "url https",
            "url http",
            "adriana1984 mar",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "united",
            "asnone united",
            "aaaa",
            "simple secure",
            "passive dns",
            "search",
            "showing",
            "class",
            "status",
            "creation date",
            "servers",
            "name servers",
            "date",
            "title error",
            "body",
            "files ip",
            "address",
            "location united",
            "asn asnone",
            "nameservers",
            "unknown",
            "ddos",
            "ipv4",
            "pulse submit",
            "url analysis"
          ],
          "references": [
            "David Bombal & Cisco Discuss: https://m.soundcloud.com/davidbombal/455-why-hack-in-when-you-can-just-log-in (not an exploit as far as I know. I watched it on YT)",
            "b7f8599765659c19eafe733a51daf8ffd1dde24bedf876c1aba7bd7f2dbf9aa2 | www.akabomedia.co.uk",
            "Insecure headers found in search histories: games.com, microsoft.com, adrianafiore1984@gmail.com , secure.login.gov, static.secure.login.gov",
            "https://secure.login.gov/events/disavow?disavowal_token=Bxut7GJU9magrrk282lmt62q0KM4iP6R9mOGNH7yz9k",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://static.secure.login.gov/packs/js/password_toggle_component-3d373a08.js",
            "https://secure.login.gov/users/password/edit?reset_password_token=B2J-ZWmp6vfu7teQ7Zvr",
            "Unsure of connection to issues:  http://www.login.gov/es/help | http://www.login.gov/es/help\\u003c | http://www.microsoft.com/lin... |",
            "http://www.microsoft.com/link | https://www.login.gov/contact | https://www.login.gov/contact/ | https://www.login.gov/es/contact",
            "https://www.login.gov/help& | https://www.login.gov/help/ | https://www.login.gov/help/__",
            "login.gov | uscis.gov | usertesting.com | www.epic |  www.login.gov | www.microsoft.com | http://games.com/activate  http://microsoft.com/link",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (password decoder)",
            "https://static.secure.login.gov/packs/js/password_toggle_component-3d373a08.js",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://secure.login.gov/users/password/edit?request_id=7ea7896d-dfb0-40c6-b75b-5fbfab101cb8",
            "https://secure.login.gov/users/password/edit?reset_password_token=B2J-ZWmp6vfu7teQ7Zvr",
            "server-18-161-6-16.hio52.r.cloudfront.net",
            "http://www.w3.org/TR/html4/loose.dtd |  128.30.52.37 | www.w3.org (definite issues)",
            "http://quantum.emsbk.com/ | deadmin.kaisa.sbs | kaisa.sbs",
            "Group commentators discussed profile link changed. Also,when some users utilize 'Suggested IoC's' , bulk IoC's' are deleted before able to be included",
            "Noticed a few users have multiple accounts w/same name, different followers, different follower count. Love this tool. Have questions about potential attacks",
            "A few haven't logged in in months or sometimes longer (life) notice pulses modified, missing or can't log in.",
            "Email issue, virustotal also affected. Some having different IP's, different language, an American user VT ; telemetry content, strings, old browsers. Total menu change",
            "Phishing: http://search.searchffr.com/?source=bing-bb9&uid=9a283646-64de-4df2-84b5-9951528bd4ed&uc=20180405&ap=appfocus63&i_id=recipes__1.30"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1088",
              "name": "Bypass User Account Control",
              "display_name": "T1088 - Bypass User Account Control"
            },
            {
              "id": "T1555.005",
              "name": "Password Managers",
              "display_name": "T1555.005 - Password Managers"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1162",
              "name": "Login Item",
              "display_name": "T1162 - Login Item"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65e9b2408fd9557692402b03",
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 196,
            "FileHash-SHA256": 1855,
            "URL": 1204,
            "domain": 225,
            "hostname": 466,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 4211,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "743 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e9b2408fd9557692402b03",
          "name": "Why are OTX pulses modified and by whom when it's not the user?",
          "description": "There are several OTC accounts that are experiencing unauthorized logins. Users have a common theme, keen awareness, learning from experiences, Apple , state, gov personal accounts of being hacked, have personal network/router , phone or relatives and.or associated (civil society) experiencing cyber attacks.Indicators are being removed at record pace. Some pulses have been deleted altogether.  Threat actors are logging in as user by exploiting or creating a vulnerability on user device or login. From what I've learned , there is a history on user device. I hope I'm still allowed to use platform after this.  I noticed some accounts were submitting and modifying 24/7. A user in a TH group forum discussed bulk deletion, non-public modified and deleted Pulses.",
          "modified": "2024-04-06T11:00:59.869000",
          "created": "2024-03-07T12:25:36.098000",
          "tags": [
            "referrer",
            "execution",
            "dropped",
            "apple ios",
            "contacted",
            "partru",
            "sneaky server",
            "replacement",
            "unauthorized",
            "emotet",
            "submission",
            "alienvault",
            "open threat",
            "learn",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "google tag",
            "gtmkvjvztk",
            "anchor hrefs",
            "urls",
            "domains",
            "registrar",
            "ltd dba",
            "com laude",
            "markmonitor",
            "ip detections",
            "country",
            "graph",
            "hashes cape",
            "sandbox",
            "zenbox",
            "files c",
            "filesgoogle c",
            "written c",
            "extensions",
            "process",
            "created",
            "processes tree",
            "hour ago",
            "scan endpoints",
            "all scoreblue",
            "report spam",
            "modified",
            "scan",
            "iocs",
            "learn more",
            "hostname",
            "filehashsha256",
            "next",
            "url https",
            "url http",
            "adriana1984 mar",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "united",
            "asnone united",
            "aaaa",
            "simple secure",
            "passive dns",
            "search",
            "showing",
            "class",
            "status",
            "creation date",
            "servers",
            "name servers",
            "date",
            "title error",
            "body",
            "files ip",
            "address",
            "location united",
            "asn asnone",
            "nameservers",
            "unknown",
            "ddos",
            "ipv4",
            "pulse submit",
            "url analysis"
          ],
          "references": [
            "David Bombal & Cisco Discuss: https://m.soundcloud.com/davidbombal/455-why-hack-in-when-you-can-just-log-in (not an exploit as far as I know. I watched it on YT)",
            "b7f8599765659c19eafe733a51daf8ffd1dde24bedf876c1aba7bd7f2dbf9aa2 | www.akabomedia.co.uk",
            "Insecure headers found in search histories: games.com, microsoft.com, adrianafiore1984@gmail.com , secure.login.gov, static.secure.login.gov",
            "https://secure.login.gov/events/disavow?disavowal_token=Bxut7GJU9magrrk282lmt62q0KM4iP6R9mOGNH7yz9k",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://static.secure.login.gov/packs/js/password_toggle_component-3d373a08.js",
            "https://secure.login.gov/users/password/edit?reset_password_token=B2J-ZWmp6vfu7teQ7Zvr",
            "Unsure of connection to issues:  http://www.login.gov/es/help | http://www.login.gov/es/help\\u003c | http://www.microsoft.com/lin... |",
            "http://www.microsoft.com/link | https://www.login.gov/contact | https://www.login.gov/contact/ | https://www.login.gov/es/contact",
            "https://www.login.gov/help& | https://www.login.gov/help/ | https://www.login.gov/help/__",
            "login.gov | uscis.gov | usertesting.com | www.epic |  www.login.gov | www.microsoft.com | http://games.com/activate  http://microsoft.com/link",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (password decoder)",
            "https://static.secure.login.gov/packs/js/password_toggle_component-3d373a08.js",
            "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
            "https://secure.login.gov/users/password/edit?request_id=7ea7896d-dfb0-40c6-b75b-5fbfab101cb8",
            "https://secure.login.gov/users/password/edit?reset_password_token=B2J-ZWmp6vfu7teQ7Zvr",
            "server-18-161-6-16.hio52.r.cloudfront.net",
            "http://www.w3.org/TR/html4/loose.dtd |  128.30.52.37 | www.w3.org (definite issues)",
            "http://quantum.emsbk.com/ | deadmin.kaisa.sbs | kaisa.sbs",
            "Group commentators discussed profile link changed. Also,when some users utilize 'Suggested IoC's' , bulk IoC's' are deleted before able to be included",
            "Noticed a few users have multiple accounts w/same name, different followers, different follower count. Love this tool. Have questions about potential attacks",
            "A few haven't logged in in months or sometimes longer (life) notice pulses modified, missing or can't log in.",
            "Email issue, virustotal also affected. Some having different IP's, different language, an American user VT ; telemetry content, strings, old browsers. Total menu change",
            "Phishing: http://search.searchffr.com/?source=bing-bb9&uid=9a283646-64de-4df2-84b5-9951528bd4ed&uc=20180405&ap=appfocus63&i_id=recipes__1.30"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1088",
              "name": "Bypass User Account Control",
              "display_name": "T1088 - Bypass User Account Control"
            },
            {
              "id": "T1555.005",
              "name": "Password Managers",
              "display_name": "T1555.005 - Password Managers"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1162",
              "name": "Login Item",
              "display_name": "T1162 - Login Item"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 39,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 196,
            "FileHash-SHA256": 1855,
            "URL": 1204,
            "domain": 225,
            "hostname": 466,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 4211,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "743 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c68bc8b8745068608cc50d",
          "name": "Metasploit | Ransomware | PinterestPots - Pin.it",
          "description": "",
          "modified": "2024-03-10T20:03:45.513000",
          "created": "2024-02-09T20:32:08.358000",
          "tags": [
            "whois record",
            "contacted",
            "tsara brashears",
            "ssl certificate",
            "apple ios",
            "unlocker",
            "historical ssl",
            "referrer",
            "highly targeted",
            "critical risk",
            "hacktool",
            "malicious",
            "cobalt strike",
            "metasploit",
            "installer",
            "malware",
            "awful",
            "android",
            "banker",
            "keylogger",
            "jeffrey reimer",
            "emreimer",
            "emily reimer goldstien",
            "eva lisa",
            "eva lisa reimer",
            "status code",
            "http response",
            "ieedge date",
            "maxage86400",
            "path",
            "httponly xcdn",
            "connection",
            "vary useragent",
            "targeting brashears",
            "communicating",
            "whois whois",
            "collections",
            "password",
            "adult content",
            "core",
            "metro",
            "apple",
            "copy",
            "suspicious",
            "vj99",
            "threat",
            "slfrd1",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls http",
            "jid1221717543",
            "slc1",
            "a domains",
            "united",
            "search",
            "date",
            "as15169 google",
            "passive dns",
            "urls",
            "record value",
            "name servers",
            "status",
            "encrypt",
            "win32",
            "next",
            "msie",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse submit",
            "url analysis",
            "body",
            "domain",
            "unknown",
            "china unknown",
            "pulse pulses",
            "files",
            "ip address",
            "servers",
            "domain name",
            "showing",
            "as54113",
            "as16625 akamai",
            "as20940",
            "aaaa",
            "cname",
            "as396982 google",
            "as14061",
            "script domains",
            "hostname",
            "japan unknown",
            "gmt content",
            "gmt etag",
            "pragma",
            "accept",
            "location japan",
            "asn as131965",
            "less",
            "pulses",
            "related tags",
            "meta",
            "asn as13335",
            "443 ma2592000",
            "certificate",
            "germany unknown",
            "script urls",
            "link",
            "code",
            "moved",
            "russia unknown",
            "as51659 llc",
            "as12616 filanc",
            "welcome",
            "uhttps",
            "urls https",
            "ccb455304",
            "ccb455307",
            "vj93",
            "uyebaauqaaaaaac",
            "malvertizing",
            "tagging",
            "prefetch8",
            "script",
            "prefetch1",
            "command decode",
            "segoe ui",
            "suricata ipv4",
            "emoji",
            "mitre att",
            "suricata udpv4",
            "roboto",
            "courier",
            "february",
            "hybrid",
            "general",
            "model",
            "comspec",
            "click",
            "strings"
          ],
          "references": [
            "https://gr.pinterest.com/emreimer/",
            "Wife of Brashears SAter \u2022 Alias \u2022 Couple plays victim \u2022 Karens. HIPPA violations. Admittedly involved cyberstalking on Brashears. Legally agreed to stop.",
            "message.htm.com \u2022 CVE-2023-4966 \u2022 ransomed.vc",
            "http://neurosky.jp",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "http://45.159.189.105/bot/regex",
            "http://alohatube.xyz/search/tsara-brashears",
            "facebooksunglassshop.com [titled' Tsara Brashears GCcmwm.T ?]",
            "alohatube.xyz  [keylogger aimed at Tsara Brashears]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.pornhub.com/video/search?search=tsara+brashears",
            "http://alohatube.xyz/search/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashears",
            "https://alohatube.xyz/search/tsara-brashears+(Formerly+Botnetwork+malvertizing+campaign+targeting+Tsara+Brashears+crime+victim.+Now+",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "manvimishraa5417@gmail.com [Video of Tsara Brashears circulation]",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language:",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.hybrid-analysis.com/sample/92b00ee3aca1f3057ad8402229c27bfdd6fc934908ef641b36379bf47093df0b/65c63a1fbc9c5333d20354ca",
            "https://www.hybrid-analysis.com/file-inline/65c63a1fbc9c5333d20354ca/screenshot/screen_6.png",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing \u2022 mitre S0154]",
            "CnC IP's: 104.124.58.137 \u2022 45.159.189.105 | Exploit source: 1.179.151.145 | scanning host: 208.115.103.34",
            "http://www.proxydocker.com/ja/proxy/43.229.135.125:8080",
            "https://twitter.com/PORNO_SEXYBABES | cloud.zemana.com - porn cloud",
            "https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/",
            "www.pornhub.com",
            "http://www.pinterest.com/ideas/songwriting/945635263947/",
            "https://www.neurosky.jp/wp-content/plugins/responsive-lightbox/assets/fancybox/jquery.fancybox.min.js?ver=2.1.0",
            "webdisk.thehomemakers.nl",
            "http://connectivitycheck.gstatic.com/generate_204 [RAT]",
            "http://discover.hubpages.com/literature/Most-Beautiful-Quotes-on-Love-and-Heartbreak  [RAT| Tagging target in adult content fraud sites]",
            "https://gujarati.ent24x7.comb [RAT]",
            "http://clipper.guru/bot/online?guid=PC\\Administrator&key=ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb",
            "https://tulach.cc/socrative/internal.js",
            "http://email.birdeye.org/c/eJxkUcFuozAU_JrHsTLPYODAIYQmSqXNqmm3q-4FGfNIrAUbGTtV-_UrklRatT5ZnvGbeTNVmLWhed6HsSVXxiLNsyLniUhFyoqolp6eyPgSE4Ysjw407boSMerKWKV90kdUxhnLuMiyhEenUiZ9LjAuij6PMWdMSpnFJPKkLVQrUhHpEtl1GEuSgvG7DIss6XsZCy7jooghYa12Hb3TnXXHaChP3k8z8BXgBnDziSk7Am4mp5U2xwXim-DHZrbBKQJeT852QfmGRqkHQLGAI3U6jMDr_x-VNZ6MB15vf1SAotUd8PpLEJ9cOU5SHw3w2ppBG2omRzMZRc1CaY0cF-21NTO5s_TaGsDqidxZK5oBq62zYQKsdkYBimmQipqL3vq0e9i3-VoOf-J09_dgq-m-enupQnUEFNp0YfbuHXgNKD70dL04Omt6a5QNF_-H-5fd_e9m_fPX_hlQyPOxuTGc9EtKvF69bJvD6",
            "https://gujarati.ent24x7.com | https://otx.alienvault.com/indicator/url/https://gujarati.ent24x7.com",
            "162.159.208.8"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Trojan:VBS/MetasploitVBSCmdStager",
              "display_name": "Trojan:VBS/MetasploitVBSCmdStager",
              "target": "/malware/Trojan:VBS/MetasploitVBSCmdStager"
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3412,
            "FileHash-MD5": 194,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 2223,
            "domain": 2117,
            "hostname": 1763,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 9875,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "770 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b865697c59050da541247f",
          "name": "Tags auto populated in original Threat Network pulse missing",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-30T02:56:41.045000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "783 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b86568e1eaace7d9f062b4",
          "name": "Tags auto populated in original Threat Network pulse missing",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-30T02:56:40.484000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "783 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b474c9c9bed0cdd00a9480",
          "name": "Spyware | Ransomware | Threat & Direct Search Network | Trellian",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-27T03:13:13.978000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b4624c5bb71879020ceb1c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "783 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4624c5bb71879020ceb1c",
          "name": "Spyware | Ransomware | Direct Search Network | Trellian",
          "description": "Large, hard to believe fraudulent threat network. Fraud services from private investigators to attorneys. Social engineering by phone, email, sponsored advertising, malvertizing, remote attacks. tracking, in person, emails, surveys, text, ongoing espionage campaigns, info stealing, cyber attacks, arrange in person meetings , identified as 'gang stalking' by detective, service staging. Very real. Bad actors take advantage of targets devices installing  overlays on windows,android. iOS. Targets can only see what adversary wants seen.\n\nLarge threat network in Colorado and abroad.\nScreenshot: https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://1redirc.com/r2.php\nCouldn't submit 1st pulse. contacted, spyware, phishing,trojan, registrar abuse",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-27T01:54:20.513000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "783 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658481716d9034bb0d52212d",
          "name": "Apple Attack | Floxif Spyware | Threat Network | Virus Network",
          "description": "Threat Network affecting and/or originating from Apple server. Malware attacks apple airpods, tv, apple store\napple trade, apple tv\napple watch, apple card, apple og?, apple server.\nSystemUpdate.dll issue. Device may partially attempt, device will show latest update, com[promised devices may have throttled update on attempt.\n\nFloxif:\nShort bio\nTrojan.Floxif is Malwarebytes\u2019 detection name for a file-changing Trojanthat targets Windows systems.\n\nSymptoms\nTrojan.Floxif can change legitimate files into infected files. Then the infected files act as a backdoor, giving the threat actor control over the machine.\n\nStaged data. Floxif primarily target Windows, Apple is less vulnerable to buy can be experience a Floxif attack.",
          "modified": "2024-01-20T14:03:29.247000",
          "created": "2023-12-21T18:18:25.746000",
          "tags": [
            "bitrep",
            "learn",
            "apple card",
            "apple",
            "apple store",
            "apple tv",
            "watch vision",
            "airpods tv",
            "apple watch",
            "buy apple",
            "apple trade",
            "footer",
            "media",
            "find",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious site",
            "hostname",
            "hostnames",
            "detection list",
            "blacklist",
            "malware",
            "alexa",
            "ip address",
            "whois record",
            "ssl certificate",
            "iocs",
            "whois whois",
            "historical ssl",
            "communicating",
            "threat network",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "attack",
            "probe",
            "search",
            "threat",
            "paste",
            "contacted",
            "april",
            "threat roundup",
            "pe resource",
            "lcid1033",
            "smlen",
            "spn647",
            "bv6fet56ww",
            "february",
            "core",
            "name verdict",
            "falcon sandbox",
            "threat analyzer",
            "samples",
            "generic malware",
            "tag count",
            "malware generic",
            "tue dec",
            "threat report",
            "summary",
            "first",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "self",
            "server apple",
            "connection",
            "html info",
            "title apple",
            "meta tags",
            "indextab og",
            "apple og",
            "spyware",
            "plugins",
            "cab",
            "fraud urls",
            "data collection",
            "staged data",
            "privilege escalation",
            "defense evasion",
            "evasive",
            "stealthy",
            "serial number",
            "symantec time",
            "stamping",
            "algorithm",
            "thumbprint",
            "from",
            "symantec sha256",
            "sha256 code",
            "signing ca",
            "class",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "win32 dll",
            "magic pe32",
            "intel",
            "ms windows",
            "compiler",
            "vs2008",
            "rticon english",
            "vs2005",
            "chi2",
            "contained",
            "info compiler",
            "products",
            "header target",
            "machine intel",
            "utc entry",
            "floxif",
            "serving ip",
            "address",
            "headers nel",
            "dynamic expires",
            "gmt server",
            "file sharing",
            "personal data"
          ],
          "references": [
            "https://www.apple.com/qtactivex/qtplugin.cab",
            "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]",
            "http://www.screensaver.com/ruxitbeacon",
            "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]",
            "http://dns1.whitelist.camect.com    [interesting]",
            "https://www.jbits.courts.state.co    [interesting]",
            "http://www.sos.state.co/                   [interesting]",
            "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary",
            "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary",
            "Crowdsourced YARA  Rulesets",
            "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems",
            "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security",
            "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth",
            "https://www.malwarebytes.com/blog/detections/trojan-floxif",
            "20.190.160.2         Microsoft  [exploit_source]",
            "20.190.160.67       Microsoft  [exploit_source]",
            "20.190.160.73       Microsoft  [exploit_source]",
            "watson.events.data.microsoft.com      [traffic manager]",
            "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181.   [stack hash]",
            "watson.telemetry.microsoft.us   [Data traffic manager]",
            "www.anyxxxtube.net [tracking]",
            "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Apple",
              "display_name": "Apple",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 609,
            "FileHash-SHA1": 361,
            "FileHash-SHA256": 1977,
            "domain": 460,
            "hostname": 992,
            "URL": 3115
          },
          "indicator_count": 7514,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fed19f6d24e751fa82de8",
          "name": "Lazarus Hosts | https://www.poemhunter.com/tsara-brashears",
          "description": "",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T06:56:25.399000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fbac9a03d611624985685",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac9a03d611624985685",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:45.890000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac7f0d96f1ad5d90ccb",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:43.483000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655af35616dbd4781c681948",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-20T05:49:10.586000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655a13e4538e896c00f2077e",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655a13e4538e896c00f2077e",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "This report is generated by MITRE ATT&CK\u2122 and produced by the team at the University of California, San Francisco, and is available on the web, via the Microsoft Research website.\nTulach, 114.114.114.114, spyware, phishing, fraud, malvertizing, password cracker, iPhone unlocker, malicious, media sharing, miscellaneous attacks.",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-19T13:55:48.898000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8ab04f4376f74586eeb",
          "name": "Compromise source",
          "description": "",
          "modified": "2023-12-06T17:00:27.266000",
          "created": "2023-12-06T17:00:27.266000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1538,
            "hostname": 1049,
            "domain": 400,
            "URL": 3075,
            "FileHash-MD5": 258,
            "FileHash-SHA1": 136
          },
          "indicator_count": 6457,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a857cae685fce7f5231e",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "",
          "modified": "2023-12-06T16:59:03.209000",
          "created": "2023-12-06T16:59:03.209000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 2052,
            "hostname": 1185,
            "domain": 460,
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a835fc0836f148fa45c8",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2023-12-06T16:58:29.243000",
          "created": "2023-12-06T16:58:29.243000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a521974bdb5d6dbda092",
          "name": "",
          "description": "",
          "modified": "2023-12-06T16:45:21.776000",
          "created": "2023-12-06T16:45:21.776000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a5109ecc3c75c949f950",
          "name": "Unsupported IE 404 account running BotNet Command & Control Server | B/L",
          "description": "",
          "modified": "2023-12-06T16:45:04.296000",
          "created": "2023-12-06T16:45:04.296000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4f322399eb1db2a07b2",
          "name": "Hijacked Pinterest Account Spreader, BotNet Control Server | Unsupported IE",
          "description": "",
          "modified": "2023-12-06T16:44:35.786000",
          "created": "2023-12-06T16:44:35.786000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4e083c4acd789ea7e58",
          "name": "Blacklisted",
          "description": "",
          "modified": "2023-12-06T16:44:16.060000",
          "created": "2023-12-06T16:44:16.060000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2258,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15663,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4d5c14495fcf65ee8a5",
          "name": "Netsky",
          "description": "",
          "modified": "2023-12-06T16:44:05.631000",
          "created": "2023-12-06T16:44:05.631000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4cb97598bac143dc90b",
          "name": "Critical: Pinterest Cyber Espionage",
          "description": "",
          "modified": "2023-12-06T16:43:55.639000",
          "created": "2023-12-06T16:43:55.639000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65463631b46319b3aa1d071f",
          "name": "Qausar RAT - aig.com |",
          "description": "Compilation of research identifilocates aig.com Defense Division of Workers Compensation. \nMalicious & invasive tactics remain. Target seem to have been removed from, revenge porn campaign targeted name no longer auto populates, registrant seems poised for campaign.\nTactics include phishing, tracking, geotracking, device location, monitoring, side loading apps and remote access. \n\nQausar Rat identified:\nAlso known by the names CinaRAT or Yggdrasil, Quasar RAT is a C#-based remote administration tool capable of gathering system information, a list of running applications, files, keystrokes, screenshots, and executing arbitrary shell commands.",
          "modified": "2023-12-04T11:01:36.202000",
          "created": "2023-11-04T12:16:49.600000",
          "tags": [
            "general full",
            "url https",
            "reverse dns",
            "security tls",
            "protocol h2",
            "name value",
            "resource",
            "united",
            "asn16509",
            "amazon02",
            "main",
            "facebook",
            "http",
            "request chain",
            "november",
            "de page",
            "url history",
            "javascript",
            "meta",
            "page url",
            "redirected",
            "http redirect",
            "value",
            "mime type",
            "variables",
            "contexthub",
            "visitor object",
            "cq function",
            "sanitize object",
            "elqq",
            "domainpath name",
            "link",
            "property",
            "workers",
            "compensation",
            "login myaig",
            "liability",
            "contact",
            "a claim",
            "commercial auto",
            "login aig",
            "form",
            "cyber",
            "find",
            "team",
            "defense",
            "crime",
            "ransom",
            "energy",
            "cargo",
            "life",
            "media",
            "enterprise",
            "american international",
            "frankfurt",
            "germany",
            "october",
            "domains",
            "asn20940",
            "cisco",
            "umbrella rank",
            "domain",
            "de summary",
            "ssl certificate",
            "whois record",
            "whois whois",
            "malware",
            "network mooooda",
            "and china",
            "filter https",
            "dsp1",
            "keepaliveyes",
            "p11642963562",
            "quasar",
            "metro",
            "android",
            "djvu",
            "win32 exe",
            "win32 dll",
            "ms excel",
            "dao360",
            "spreadsheet",
            "files",
            "detections type",
            "name",
            "phishing",
            "tulach exploits",
            "falcon sandbox",
            "pattern match",
            "file",
            "script",
            "indicator",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "date",
            "unknown",
            "body",
            "error",
            "span",
            "class",
            "generator",
            "critical",
            "refresh",
            "open",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "suricata"
          ],
          "references": [
            "aig.com",
            "https://urlscan.io",
            "https://www.slatergordon.com.au/blog/revenge-porn-laws",
            "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1",
            "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311",
            "remoteaccess.aig.com",
            "https://remote.goeaston.net",
            "window.location.search",
            "location.search",
            "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk",
            "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net",
            "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/"
          ],
          "public": 1,
          "adversary": "American International",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "American International",
              "display_name": "American International",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [
            "Reinsurance",
            "Travel"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 1962,
            "domain": 575,
            "hostname": 1623,
            "FileHash-MD5": 123,
            "URL": 3670,
            "CVE": 2
          },
          "indicator_count": 8072,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "867 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1bb52be2aeb5dd9bc1bd",
          "name": "Compromise source",
          "description": "",
          "modified": "2023-11-09T07:00:30.123000",
          "created": "2023-10-30T02:57:57.332000",
          "tags": [
            "united",
            "cyber threat",
            "phishing site",
            "malware site",
            "malicious site",
            "malware",
            "redline stealer",
            "hostname",
            "phishing",
            "cronup threat",
            "installcore",
            "ransomware",
            "emotet",
            "site",
            "cisco umbrella",
            "detection list",
            "blacklist http",
            "kt339",
            "kbc510384",
            "ki31498750",
            "ktd256",
            "kld1061",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "downloader",
            "hybridanalysis",
            "online sun",
            "online sat",
            "thu jul",
            "reverse ip",
            "lookups date",
            "sun sep",
            "online wed"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65250c1c8370f375f5c9f722",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 3075,
            "domain": 401,
            "hostname": 1049,
            "FileHash-SHA1": 136,
            "FileHash-MD5": 258,
            "FileHash-SHA256": 1538
          },
          "indicator_count": 6458,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65250c1c8370f375f5c9f722",
          "name": "Compromise source",
          "description": "phishing, exploit_source, trojan, malvertizing, adult content, installers, malware",
          "modified": "2023-11-09T07:00:30.123000",
          "created": "2023-10-10T08:32:28.546000",
          "tags": [
            "united",
            "cyber threat",
            "phishing site",
            "malware site",
            "malicious site",
            "malware",
            "redline stealer",
            "hostname",
            "phishing",
            "cronup threat",
            "installcore",
            "ransomware",
            "emotet",
            "site",
            "cisco umbrella",
            "detection list",
            "blacklist http",
            "kt339",
            "kbc510384",
            "ki31498750",
            "ktd256",
            "kld1061",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "downloader",
            "hybridanalysis",
            "online sun",
            "online sat",
            "thu jul",
            "reverse ip",
            "lookups date",
            "sun sep",
            "online wed"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 3075,
            "domain": 401,
            "hostname": 1049,
            "FileHash-SHA1": 136,
            "FileHash-MD5": 258,
            "FileHash-SHA256": 1538
          },
          "indicator_count": 6458,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f155cf81da97fd82bba62",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "",
          "modified": "2023-11-09T05:05:01.692000",
          "created": "2023-10-30T02:30:52.720000",
          "tags": [
            "whois record",
            "contacted",
            "ssl certificate",
            "parent",
            "historical ssl",
            "communicating",
            "siblings",
            "execution",
            "resolutions",
            "collections",
            "malicious",
            "generic malware",
            "hybridanalysis",
            "fri jan",
            "mon jan",
            "date filename",
            "blacklist fri",
            "install league",
            "legends",
            "fri dec",
            "sun jan",
            "allusersprofile",
            "osuser",
            "dns requests",
            "process list",
            "gamesmetadata",
            "cisco umbrella",
            "site",
            "mon jul",
            "online thu",
            "safe site",
            "malware",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "inc validity",
            "relic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6524f2a85b4dd064922b8c7a",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11,
            "FileHash-SHA256": 2052,
            "domain": 460,
            "hostname": 1185,
            "CVE": 1
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6524f2a85b4dd064922b8c7a",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "Phishing\nAPT's\nAnonymization\nProxy: FireHOL\ncloud collector-newrelic\nG0032 - Lazarus Group 03/2023\nAS23467 New Relic",
          "modified": "2023-11-09T05:05:01.692000",
          "created": "2023-10-10T06:43:52.526000",
          "tags": [
            "whois record",
            "contacted",
            "ssl certificate",
            "parent",
            "historical ssl",
            "communicating",
            "siblings",
            "execution",
            "resolutions",
            "collections",
            "malicious",
            "generic malware",
            "hybridanalysis",
            "fri jan",
            "mon jan",
            "date filename",
            "blacklist fri",
            "install league",
            "legends",
            "fri dec",
            "sun jan",
            "allusersprofile",
            "osuser",
            "dns requests",
            "process list",
            "gamesmetadata",
            "cisco umbrella",
            "site",
            "mon jul",
            "online thu",
            "safe site",
            "malware",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "inc validity",
            "relic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11,
            "FileHash-SHA256": 2052,
            "domain": 460,
            "hostname": 1185,
            "CVE": 1
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f203d9b8cd815d8b5134c",
          "name": "Unsupported IE 404 account running BotNet Command & Control",
          "description": "",
          "modified": "2023-10-30T03:17:17.770000",
          "created": "2023-10-30T03:17:17.770000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6523344e4adc85389899504c",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "902 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
        "https://alohatube.xyz/search/tsara-brashears",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "https://home.pl/regulaminy",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://static.secure.login.gov/packs/js/password_toggle_component-3d373a08.js",
        "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311",
        "Noticed a few users have multiple accounts w/same name, different followers, different follower count. Love this tool. Have questions about potential attacks",
        "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]",
        "remoteaccess.aig.com",
        "CS IDS: Matches rule ET MALWARE Win32/Ramnit Checkin Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "http://www.Apple.com/quicktime/download",
        "https://www.pornhub.com/video/search?search=tsara+brashears",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "init.ess.apple.com        (remote hacking)",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary",
        "https://www.neurosky.jp/wp-content/plugins/responsive-lightbox/assets/fancybox/jquery.fancybox.min.js?ver=2.1.0",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "http://connectivitycheck.gstatic.com/generate_204 [RAT]",
        "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "https://www.login.gov/help& | https://www.login.gov/help/ | https://www.login.gov/help/__",
        "https://www.apple.com/sitemap/",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "www.anyxxxtube.net [tracking]",
        "https://www.apple.com/qtactivex/qtplugin.cab",
        "message.htm.com \u2022 CVE-2023-4966 \u2022 ransomed.vc",
        "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "aig.com",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "This is hard to comprehend or put into indelible words.",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "*Andariel Backdoor Activity (Checkin)",
        "www.pornhub.com",
        "Online Research",
        "https://support.Apple.com/de",
        "http://193.233.132.62/hera/amadka.exe | https://www.info-only-men.com/landing/mlp88g?subPublisher=popunder:eu-adsrv.rtbsuperhub.com&zone=popunder:eu-adsrv.rtbsuperhub.com&",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "ET Telnet |  https://www.colocrossing.com | velocity servers",
        "server-18-161-6-16.hio52.r.cloudfront.net",
        "All - EnterpriseAppsList.csv",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]",
        "apple.com.        (malicious version/header)",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
        "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
        "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
        "Data Analysis",
        "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
        "Yara Detections is__elf",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
        "162.159.208.8",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://home.pl/login",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "CS IDS: Matches rule (http_inspect) HTTP response has UTF character set that failed to normalize",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "http://www.pinterest.com/ideas/songwriting/945635263947/",
        "MALWARE STEALER TROJAN EVADER | WEXTRACT.EXE .MUI | TXTRESSE | via https://www.virustotal.com/gui/domain/www.youtube.com",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "https://urlscan.io",
        "Wife of Brashears SAter \u2022 Alias \u2022 Couple plays victim \u2022 Karens. HIPPA violations. Admittedly involved cyberstalking on Brashears. Legally agreed to stop.",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "Roksit.net",
        "https://gr.pinterest.com/emreimer/",
        "20.190.160.73       Microsoft  [exploit_source]",
        "Group commentators discussed profile link changed. Also,when some users utilize 'Suggested IoC's' , bulk IoC's' are deleted before able to be included",
        "https://www.hybrid-analysis.com/file-inline/65c63a1fbc9c5333d20354ca/screenshot/screen_6.png",
        "Devices remotely connected, tracked , monitored",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "Self whitelisting tool, domains moved within nginx.",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashears+(Formerly+Botnetwork+malvertizing+campaign+targeting+Tsara+Brashears+crime+victim.+Now+",
        "Crowdsourced YARA rules: Matches rule win_ramnit_auto from ruleset win.ramnit_auto by Felix Bilstein - yara-signator at cocacoding dot com",
        "Antivirus Detections: Backdoor:Win32/Likseput.B ,  PWS:Win32/QQpass.B!MTB ,  Trojan:Win32/Scrarev.C ,  Trojan:Win32/Speesipro.A ,  Trojan:Win32/Zombie.A ,  TrojanDownloader:Win32/Cutwail.BS ,  TrojanDownloader:Win32/Nemucod ,",
        "104.21.51.140, 172.67.181.41",
        "Data Analytics",
        "45.159.189.105                                                (Command and Control)",
        "https://software-free-phone-2018.win/7a7c1101-0538-49de-925f-4f4675a5fd1f/3b0669f6-a07e-4eb8-8e2b-d0282d482c1a/?brand=Lenovo&browser=Chr",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration)",
        "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "facebooksunglassshop.com [titled' Tsara Brashears GCcmwm.T ?]",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "https://www.youtube.com/watch?v=GyuMozsVyYs",
        "Phishing: http://search.searchffr.com/?source=bing-bb9&uid=9a283646-64de-4df2-84b5-9951528bd4ed&uc=20180405&ap=appfocus63&i_id=recipes__1.30",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "(Can't access file- Malware infection files)",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "http://www.w3.org/TR/html4/loose.dtd |  128.30.52.37 | www.w3.org (definite issues)",
        "Email issue, virustotal also affected. Some having different IP's, different language, an American user VT ; telemetry content, strings, old browsers. Total menu change",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
        "20.190.160.2         Microsoft  [exploit_source]",
        "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1",
        "location.search",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "A few haven't logged in in months or sometimes longer (life) notice pulses modified, missing or can't log in.",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "CS IDS: Matches rule (stream_tcp) data sent on stream not accepting data",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "http://neurosky.jp",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "^ by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) ^",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.slatergordon.com.au/blog/revenge-porn-laws",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181.   [stack hash]",
        "CS IDS: Matches rule ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "Insecure headers found in search histories: games.com, microsoft.com, adrianafiore1984@gmail.com , secure.login.gov, static.secure.login.gov",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing \u2022 mitre S0154]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (password decoder)",
        "Remotewd.com devices",
        "Crowdsourced YARA rules: Matches rule MAL_Ramnit_May19_1 from ruleset crime_nansh0u by Florian Roth (Nextron Systems)",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
        "Crowdsourced IDS rules: Matches rule: (port_scan) UDP filtered",
        "https://www.malwarebytes.com/blog/detections/trojan-floxif",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "http://www.microsoft.com/link | https://www.login.gov/contact | https://www.login.gov/contact/ | https://www.login.gov/es/contact",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "WebTools",
        "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "https://www.home.pl/regulaminy",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token)  Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP)",
        "(legitimate services will remain up-and-running usually) High |  ID dead_host",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "remote.telegrafix.com          (remote hacking)",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "CS Sigma: Matches rule Suspicious Schtasks Schedule Type With High Privileges by Nasreddine Bencherchali (Nextron Systems)",
        "https://gujarati.ent24x7.com | https://otx.alienvault.com/indicator/url/https://gujarati.ent24x7.com",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "TXTRESSE: FileHash-SHA256 00001dd58b69582cc30a16b000bce3d96d369487444385489084719676afba4d",
        "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
        "login.gov | uscis.gov | usertesting.com | www.epic |  www.login.gov | www.microsoft.com | http://games.com/activate  http://microsoft.com/link",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "manvimishraa5417@gmail.com [Video of Tsara Brashears circulation]",
        "https://pomoc.home.pl/faq/5",
        "https://twitter.com/PORNO_SEXYBABES | cloud.zemana.com - porn cloud",
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
        "CS IDS: Matches rule ET MALWARE Suspected RisePro TCP Heartbeat Packet",
        "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://quantum.emsbk.com/ | deadmin.kaisa.sbs | kaisa.sbs",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "CS Sigma: Matches rule Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, J\u00e1n Tren\u010dansk\u00fd, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan",
        "https://otx.alienvault.com/pulse/6694bb9be1b61bf820500004",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "Alienvault OTX",
        "nr-data.net [Apple Private Data Collection]",
        "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
        "https://software-free-phone-2018.win/62ae8f9b-d0cb-4b4c-8318-dd7900e1d092/e29481e9-a792-46a8-bbf0-188ed2a816ae/?brand=Apple&browser=Safari&btd=dHJr",
        "sentient.industries affects independent artists. Affects several others.",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "window.location.search",
        "http://alohatube.xyz/search/tsara-brashears/",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "Crowdsourced Signa: Schedule system process by Joe Security",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "20.190.160.67       Microsoft  [exploit_source]",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "Crowdsourced IDS rules: Matches rule: MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/",
        "CS Sigma: Matches rule Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)",
        "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Backdoor.Win32.Pushdo.s Checkin Suspicious csrss.exe in URI",
        "applepaydayloans.com",
        "b7f8599765659c19eafe733a51daf8ffd1dde24bedf876c1aba7bd7f2dbf9aa2 | www.akabomedia.co.uk",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "alohatube.xyz  [keylogger aimed at Tsara Brashears]",
        "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2",
        "https://rector-fitiology.icu/99c8d3a6-be16-421a-87a8-40701eae8149?zoneid=6543079&bannerid=18710758&browser=chrome&os=ios&devic",
        "*Themida_2xx. Oreans,Technologies",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://remote.goeaston.net",
        "watson.telemetry.microsoft.us   [Data traffic manager]",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "http://email.birdeye.org/c/eJxkUcFuozAU_JrHsTLPYODAIYQmSqXNqmm3q-4FGfNIrAUbGTtV-_UrklRatT5ZnvGbeTNVmLWhed6HsSVXxiLNsyLniUhFyoqolp6eyPgSE4Ysjw407boSMerKWKV90kdUxhnLuMiyhEenUiZ9LjAuij6PMWdMSpnFJPKkLVQrUhHpEtl1GEuSgvG7DIss6XsZCy7jooghYa12Hb3TnXXHaChP3k8z8BXgBnDziSk7Am4mp5U2xwXim-DHZrbBKQJeT852QfmGRqkHQLGAI3U6jMDr_x-VNZ6MB15vf1SAotUd8PpLEJ9cOU5SHw3w2ppBG2omRzMZRc1CaY0cF-21NTO5s_TaGsDqidxZK5oBq62zYQKsdkYBimmQipqL3vq0e9i3-VoOf-J09_dgq-m-enupQnUEFNp0YfbuHXgNKD70dL04Omt6a5QNF_-H-5fd_e9m_fPX_hlQyPOxuTGc9EtKvF69bJvD6",
        "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth",
        "watson.events.data.microsoft.com      [traffic manager]",
        "CS Sigma: Matches rule Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke",
        "http://www.proxydocker.com/ja/proxy/43.229.135.125:8080",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "CnC IP's: 104.124.58.137 \u2022 45.159.189.105 | Exploit source: 1.179.151.145 | scanning host: 208.115.103.34",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "https://secure.login.gov/users/password/edit?request_id=5aa8520c-5fb1-4db9-b52f-39fee61ba899&reset_password_token=T318N3voD8NtXgE_1er2",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "https://www.virustotal.com/gui/file/00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4/detection",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "Critical CS Sigma: Matches rule Suspicious Double Extension File Execution by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)",
        "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
        "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security",
        "http://ww1.tsx.org/_fd",
        "http://www.sos.state.co/                   [interesting]",
        "webdisk.thehomemakers.nl",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
        "AppRegistrationList.csv",
        "http://www.screensaver.com/ruxitbeacon",
        "https://www.jbits.courts.state.co    [interesting]",
        "Crowdsourced IDS rules: Matches rule: ET MALWARE Win32/Ramnit Checkin | Matches rule ET DNS Query for .cc TLD",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "https://secure.login.gov/events/disavow?disavowal_token=Bxut7GJU9magrrk282lmt62q0KM4iP6R9mOGNH7yz9k",
        "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "WEXTRACT.EXE .MUI: FileHash-SHA256 00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4",
        "https://www.virustotal.com/gui/collection/789999053bd7022e2d79a887a5f959be573ce57d6c4f3165503438fbd5dd9ad5/graph",
        "remote.haverhillcc.com        (remote hacking)",
        "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
        "TrojanDownloader:Win32/Upatre ,  Virus:Win32/Sality.AT , Win.Downloader.Small-1645",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "https://www.colocrossing.com/",
        "http://alohatube.xyz/search/tsara-brashears",
        "http://www.home.pl/",
        "CS Sigma: Matches rule Suspicious Add Scheduled Task Parent by Florian Roth (Nextron Systems)",
        "https://home.pl/cennik",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
        "https://www.hybrid-analysis.com/sample/92b00ee3aca1f3057ad8402229c27bfdd6fc934908ef641b36379bf47093df0b/65c63a1fbc9c5333d20354ca",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "http://45.159.189.105/bot/regex",
        "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
        "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Activity)",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "David Bombal & Cisco Discuss: https://m.soundcloud.com/davidbombal/455-why-hack-in-when-you-can-just-log-in (not an exploit as far as I know. I watched it on YT)",
        "CS IDS: Matches rule ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://secure.login.gov/users/password/edit?reset_password_token=B2J-ZWmp6vfu7teQ7Zvr",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
        "http://discover.hubpages.com/literature/Most-Beautiful-Quotes-on-Love-and-Heartbreak  [RAT| Tagging target in adult content fraud sites]",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://tulach.cc/socrative/internal.js",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net",
        "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "https://applepaydayloans.com/",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://secure.login.gov/users/password/edit?request_id=7ea7896d-dfb0-40c6-b75b-5fbfab101cb8",
        "Crowdsourced YARA  Rulesets",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "If you find anything interesting please research it.",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language:",
        "Unsure of connection to issues:  http://www.login.gov/es/help | http://www.login.gov/es/help\\u003c | http://www.microsoft.com/lin... |",
        "Behavior Pattern Match Analysis",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://gujarati.ent24x7.comb [RAT]",
        "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
        "http://clipper.guru/bot/online?guid=PC\\Administrator&key=ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb",
        "http://www.home.pl./",
        "https://urlscan.io/search/#ualberta.ca",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "Jays Youtube Bot.exe > FileHash-SHA256 00514527e00ee001d042",
        "IDS: WGET Command Specifying Output in HTTP Headers",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "CS Sigma: Matches rule Scheduled Task Creation by Florian Roth (Nextron Systems)",
        "http://dns1.whitelist.camect.com    [interesting]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "American International"
          ],
          "malware_families": [
            "Trojan.crifi.1",
            "Trojan:win32/zombie.a",
            "Elf:ddos-y\\ [trj]",
            "Trojan.msil.injurer.cbd",
            "Script exploit",
            "Virus.ramnit/nimnul",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Keyloggers",
            "Zbot",
            "W32.hack.generic",
            "Redline stealer",
            "Trojan.ole2.vbs",
            "Generic.31fcc75f",
            "Alf:heraklezeval:trojandownloader:html/adodb!rfn",
            "Unix.trojan.darknexus-7679166-0",
            "Qvm20.1.8d80.malware",
            "Anonymizer",
            "Gen:variant.zusy",
            "Trojan.ransom.generickd",
            "Dotnet",
            "Wat:blacked-e",
            "Win.downloader.109205-1",
            "Apnic",
            "Skynet",
            "Ml.generic",
            "Trojan:vbs/metasploitvbscmdstager",
            "Alf:jasyp:pua:win32/bibado",
            "Trojan:win32/blihan.a",
            "#lowfienabledtcontinueafterunpacking",
            "Win32:rmndrp [inf]",
            "Win.trojan.bulz-9860169-0",
            "Pegasus",
            "Pws:msil/steam",
            "Win.trojan.jorik-149",
            "Backdoor.mokes",
            "Apple",
            "Nufs_inno",
            "#lowfi:hstr:msil/malicious",
            "Trojan:win32/speesipro.a",
            "Tel:delphi/obfuscator",
            "#hstr:hacktool:win32/mimikatz",
            "Trojandropper:win32/muldrop.v!mtb",
            "Undefined 1\tms 1\txyz 1\tgl 1\tnet tld aggregation com ms xyz gl net 20% 20% 20% 20% 20% tld\tcount com\t1 undefined\tnan ms\t1 xyz\t1 gl\t1 net\t1   combined blacklist timeline hybrid-analysis maltiverse resea",
            "Trojandropper:win32/vb.il",
            "Quasar rat",
            "Win.malware.midie-6847892-0",
            "Pws:win32/qqpass.b!mtb",
            "Proxy",
            "Alf:pulzati:worm:win32/mydoom",
            "Backdoor:msil/quasarrat",
            "Mydoom",
            "Gamehack.dr",
            "Hacktool",
            "Win.malware.ursu-9856871-0",
            "Worm:win32/benjamin",
            "Win.downloader.small-1645",
            "Trojan:win32/gandcrab",
            "#exploit:win32/cve- 2023 - 23397",
            "Ransomware",
            "Sdbot.caoc",
            "Maltiverse",
            "Trojanspy",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "Phish.ab",
            "Win.trojan.jorik-130",
            "Cobalt strike",
            "#lowfidetectsvmware",
            "Win32:downloader-gjk\\ [trj]",
            "Laplasclipper",
            "Win32/nemucod",
            "Relic",
            "Trojan.generic",
            "Tulach",
            "Alf:program:opencandy:remnant",
            "American international",
            "Ai:fileinfector.eaeea7850c",
            "Dropper.binder",
            "Malicious.22a4c0",
            "Trojandropper:win32/muldrop",
            "Unix.trojan.mirai-6981169-0",
            "Worm:win32/netsky",
            "Pws",
            "Bulz",
            "Trojandownloader:win32/nemucod",
            "Ddos:win32/stormser.a",
            "Fragtor",
            "Alf:heraklezeval:trojanspy:win32/socstealer",
            "Alf:hstr:dotnet",
            "Trojan:win32/scrarev.c",
            "Gen:variant.razy",
            "Trojandownloader:win32/cutwail.bs",
            "Xanfpezes.a",
            "Ramnit",
            "Wannacry",
            "Win.packed.razy-9785185-0",
            "Backdoor:msil/asyncrat",
            "Win.malware (30)",
            "Generic.asmalws          malicious_confidence_70% 1\til:trojan.msilzilla 1\tfilerepmalware 1\transom.sabsik 1\tbehaveslike.dropper 1\tmicrosoft phishing 1\tbackdoor.mokes 1\tphishing bank of america corporat",
            "Gen:variant.bulz",
            "Hacktool:win32/autokms",
            "Trojan:win32/zbot.sibl!mtb",
            "Foundry",
            "Artemis",
            "Worm:win32/mofksys.rnd!mtb",
            "Adware.dropware",
            "Adwaresig [adw] ml.generic",
            "Malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tunsafe.ai_score_98% 1\tmobigame 1\tbanker,evasive,retefe 1\tprogram.unwanted 1\tmalicious.high.ml 1\tkryptik.dawvk 1\tunsafe.ai_score_91% 1\tadwar",
            "Quasar",
            "Generic.malware",
            "Mirai",
            "Hacktool:msil/boilod.c!bit",
            "Sodin ransomware",
            "Trojan:win32/comisproc!gmb",
            "Custom malware",
            "Malware",
            "Cobalt strike - s0154",
            "Win.malware.kolab-9885903-0",
            "Tel:trojan:win32/emotet",
            "Backdoor:win32/likseput.b",
            "Sova",
            "Slfper:installcore",
            "Trojan:win32/toga",
            "Trojan.html.agent",
            "Virus:win32/sality.at",
            "Trojan:win32/glupteba.mt!mtb",
            "#lowfi:hstr:msil/malicious.decryption",
            "Blacknet",
            "Win.trojan.fakecodecs-119",
            "Win.trojan.generic-9862772-0",
            "E5",
            "Trojandownloader:win32/upatre",
            "Malware.generic",
            "Ransom"
          ],
          "industries": [
            "Media",
            "Crime victims",
            "Insurance",
            "Education",
            "Government",
            "Reinsurance",
            "Healthcare",
            "Technology",
            "Hacking",
            "Telecommunications",
            "Civil society",
            "Travel",
            "Social media"
          ],
          "unique_indicators": 341537
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mccune.ca",
    "whois": "http://whois.domaintools.com/mccune.ca",
    "domain": "mccune.ca",
    "hostname": "test.mccune.ca"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 50,
  "pulses": [
    {
      "id": "6958780c8479a9d69920c3d8",
      "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack",
      "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD  forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.",
      "modified": "2026-02-02T01:02:46.327000",
      "created": "2026-01-03T01:59:40.530000",
      "tags": [
        "united",
        "moved",
        "title",
        "passive dns",
        "ipv4 add",
        "urls",
        "files",
        "hosting",
        "reverse dns",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender mar",
        "read c",
        "create c",
        "medium",
        "search",
        "memcommit",
        "high",
        "checks",
        "windows",
        "execution",
        "dock",
        "write",
        "persistence",
        "capture",
        "local",
        "ref b",
        "wed may",
        "backdoor",
        "mtb aug",
        "next associated",
        "mtb dec",
        "twitter",
        "smoke loader",
        "malware",
        "virtool",
        "hacktool",
        "data upload",
        "present dec",
        "mtb apr",
        "win32",
        "trojan",
        "worm",
        "lowfi",
        "cybota",
        "expiration date",
        "name servers",
        "ipv4",
        "url analysis",
        "port",
        "destination",
        "telnet login",
        "bad login",
        "gpl telnet",
        "suspicious path",
        "busybox",
        "tcp syn",
        "et telnet",
        "path",
        "mirai",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "america",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "learn",
        "t1179 hooking",
        "installs",
        "t1035 service",
        "adversaries",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "y013",
        "flag",
        "span",
        "accept",
        "core",
        "february",
        "hybrid",
        "malicious",
        "general",
        "click",
        "strings",
        "roboto",
        "next",
        "usa windows",
        "finished",
        "queueprogress",
        "timestamp input",
        "threat level",
        "october",
        "september",
        "hwp support",
        "fresh",
        "win64",
        "khtml",
        "gecko",
        "brand",
        "microsoft edge",
        "programfiles",
        "comspec",
        "model",
        "iframe",
        "form",
        "listeners",
        "initial access",
        "t1590 gather",
        "victim network",
        "ssl certificate",
        "quasi government",
        "jeffrey reimer",
        "palantir",
        "Regis university",
        "otx hp",
        "apple",
        "pegasus",
        "h5 data center",
        "florence colorado",
        "brian sabey",
        "target : Tsara Brasheaers",
        "aig",
        "industry and commerce",
        "united states",
        "State of Colorado.",
        "date",
        "status",
        "domain",
        "hostname add",
        "pulse pulses",
        "files ip",
        "address",
        "url https",
        "url http",
        "hostname",
        "show",
        "type indicator",
        "source hostname",
        "entries",
        "Prometheus Intelligence Technology",
        "pulse submit",
        "america flag",
        "body",
        "dynamicloader",
        "microsoft azure",
        "tls issuing",
        "named pipe",
        "json",
        "ascii text",
        "lredmond",
        "Apple",
        "Telnet",
        "BusyBox",
        "Pegasus",
        "Colorado State Fixer: Christopher P. Ahmann",
        "Hijacker: Brian Sabey",
        "For: Concentra",
        "Protecting Assaulter: Jeffrey Reimer",
        "For: AIG",
        "For Industry and Commerce",
        "For: Quasi Government",
        "For: Workers Compensation",
        "Authorities",
        "Law Enforcement Dark",
        "Silencing",
        "Tampering with a Victim",
        "Meta",
        "Palantir",
        "Google",
        "Bing",
        "Microsoft",
        "ColoCrossing",
        "Associates",
        "hit men"
      ],
      "references": [
        "ET Telnet |  https://www.colocrossing.com | velocity servers",
        "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
        "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
        "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
        "(legitimate services will remain up-and-running usually) High |  ID dead_host",
        "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
        "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
        "Yara Detections is__elf",
        "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
        "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
        "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
        "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
        "https://www.colocrossing.com/",
        "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
        "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
        "104.21.51.140, 172.67.181.41",
        "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
        "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
        "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
        "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
        "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
        "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
        "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
        "This is hard to comprehend or put into indelible words."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Unix.Trojan.DarkNexus-7679166-0",
          "display_name": "Unix.Trojan.DarkNexus-7679166-0",
          "target": null
        },
        {
          "id": "HackTool:MSIL/Boilod.C!bit",
          "display_name": "HackTool:MSIL/Boilod.C!bit",
          "target": "/malware/HackTool:MSIL/Boilod.C!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1098",
          "name": "Account Manipulation",
          "display_name": "T1098 - Account Manipulation"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1462",
          "name": "Malicious Software Development Tools",
          "display_name": "T1462 - Malicious Software Development Tools"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Technology",
        "Healthcare",
        "Insurance",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6390,
        "domain": 723,
        "hostname": 1978,
        "FileHash-SHA256": 1912,
        "FileHash-MD5": 410,
        "FileHash-SHA1": 306,
        "email": 3,
        "SSLCertFingerprint": 28,
        "CVE": 3
      },
      "indicator_count": 11753,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "76 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68feb98a8c1b75b4431a3e8e",
      "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
      "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
      "modified": "2025-11-25T20:05:31.749000",
      "created": "2025-10-27T00:15:06.191000",
      "tags": [
        "html internet",
        "html document",
        "ascii text",
        "language",
        "cve202323397",
        "iframe tags",
        "tag manager",
        "gtmkvjvztk",
        "anchor hrefs",
        "info ta0011",
        "protocol",
        "layer protocol",
        "port",
        "t1571 encrypted",
        "channel",
        "t1573 malware",
        "tree",
        "oc0006 http",
        "c0014",
        "get http",
        "dns resolutions",
        "resolved ips",
        "user",
        "data",
        "datacrashpad",
        "edge",
        "v full",
        "reports v",
        "chrome u",
        "appdata local",
        "googlechrome u",
        "u ser",
        "cname",
        "ip address",
        "http",
        "accept",
        "network dropped",
        "duration cuckoo",
        "version file",
        "machine label",
        "shutdown",
        "extraction",
        "suggested iocs",
        "data upload",
        "cry dee",
        "stop",
        "type",
        "url indicator",
        "enter",
        "failed",
        "se share",
        "extrac",
        "enter so",
        "passive dns",
        "urls",
        "hostname add",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as20473",
        "dynamicloader",
        "directui",
        "write c",
        "intel",
        "ms windows",
        "pe32",
        "element",
        "delete c",
        "document file",
        "v2 document",
        "explorer",
        "trojandropper",
        "write",
        "markus",
        "august",
        "movie",
        "insert",
        "pulse submit",
        "url analysis",
        "asn as8068",
        "united",
        "entries",
        "body",
        "please",
        "x msedge",
        "ipv4 add",
        "present sep",
        "present oct",
        "present feb",
        "status",
        "unknown ns",
        "search",
        "name servers",
        "present jul",
        "aaaa",
        "present apr",
        "trojan",
        "medium",
        "high",
        "yara rule",
        "globalc",
        "june",
        "malware",
        "win64",
        "unknown",
        "america flag",
        "twitter",
        "hostname",
        "domain add",
        "reverse dns",
        "america asn",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "unknown aaaa",
        "title",
        "meta",
        "window",
        "encrypt",
        "pulse indicator",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "atlanta",
        "abuse",
        "agent",
        "service",
        "present jun",
        "present may",
        "creation date",
        "record value",
        "servers",
        "libretv meta",
        "certificate",
        "value",
        "whois lookup",
        "loopia ab",
        "userlolxxl"
      ],
      "references": [
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        },
        {
          "id": "Foundry",
          "display_name": "Foundry",
          "target": null
        },
        {
          "id": "Trojan:Win32/Comisproc!gmb",
          "display_name": "Trojan:Win32/Comisproc!gmb",
          "target": "/malware/Trojan:Win32/Comisproc!gmb"
        },
        {
          "id": "Trojandropper:Win32/VB.IL",
          "display_name": "Trojandropper:Win32/VB.IL",
          "target": "/malware/Trojandropper:Win32/VB.IL"
        },
        {
          "id": "#Exploit:Win32/CVE- 2023 - 23397",
          "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
          "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "ALF:PulZati:Worm:Win32/Mydoom",
          "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 8,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 248,
        "FileHash-SHA1": 134,
        "FileHash-SHA256": 2661,
        "URL": 6257,
        "domain": 682,
        "email": 8,
        "hostname": 2077,
        "CVE": 1
      },
      "indicator_count": 12068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "145 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fd0cc422cea2fd989581fd",
      "name": "LevelBlue - Open Threat Exchange (Malicious Attacks)",
      "description": "I\u2019ll\nrefer to these bad actors as the .lol .fun group. London, Australia , South Africa with US base External resources. With this group, you e probably met though attackers.. OTX errors! Difficult to pulse. There are some profiles in here that are shady and attempt or do co connect to your products. They usually begin social engineering by saying that you have a \u2018problem\u2019 just like they do. Say they are from Canada or\nFrance , somewhere abroad when they are down the street using your services. There was user \u2018Merkd\u2019 whose entire system seem to become infected by someone or someone about this platform. Check the IP address at all\nTo see if it matches or is on the same block as OTC, region will show as well. Hackers may potentially cnc / move your profile on their own block. What happened today was weird. Alien Vault became a PHP and turned bright pink and black, requesting I download page. Keep your systems locked down if you\u2019re researching not reporting vulnerabilities.",
      "modified": "2025-11-24T17:02:12.441000",
      "created": "2025-10-25T17:45:40.291000",
      "tags": [
        "ipv4",
        "levelblue",
        "open threat",
        "date sat",
        "connection",
        "etag w",
        "cloudfront",
        "sameorigin age",
        "vary",
        "ip address",
        "kb body",
        "gtmkvjvztk",
        "utc gcfezl5ynvb",
        "utc na",
        "utc google",
        "analytics na",
        "utc linkedin",
        "insight tag",
        "learn",
        "exchange og",
        "levelblue open",
        "threat exchange",
        "exchange",
        "google tag",
        "iocs",
        "search otx",
        "included iocs",
        "review iocs",
        "data upload",
        "extraction",
        "layer protocol",
        "v full",
        "reports v",
        "port t1571",
        "t1573",
        "oc0006 http",
        "c0014",
        "get http",
        "dns resolutions",
        "user",
        "data",
        "datacrashpad",
        "edge",
        "tag manager",
        "us er",
        "help files",
        "shell",
        "html",
        "cve202323397",
        "iframe tags",
        "community score",
        "url http",
        "url https",
        "united",
        "united kingdom",
        "netherlands",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "indicator role",
        "title added",
        "active related",
        "otc oct",
        "report spam",
        "week ago",
        "scan",
        "learn more",
        "filehashmd5",
        "filehashsha1",
        "domain",
        "australia",
        "does",
        "josh",
        "created",
        "filehashsha256",
        "present jul",
        "present oct",
        "date",
        "a domains",
        "script urls",
        "for privacy",
        "moved",
        "script domains",
        "meta",
        "title",
        "body",
        "pragma",
        "encrypt",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1027",
        "files",
        "information",
        "t1055",
        "injection",
        "capture",
        "south korea",
        "malaysia",
        "pulses",
        "fatal error",
        "hacker known",
        "name",
        "unknown",
        "risk",
        "weeks ago",
        "scary",
        "sova",
        "colorado",
        "wire",
        "name unknown",
        "thursday",
        "denver",
        "types of",
        "indicators hong",
        "kong",
        "tsara brashears",
        "african",
        "ethiopia",
        "b8reactjs",
        "india",
        "america",
        "x ua",
        "hostname",
        "dicator role",
        "pulses url",
        "airplane",
        "icator role",
        "t1432",
        "access contact",
        "list",
        "t1525",
        "image",
        "security scan",
        "heuristic oct",
        "discovery",
        "t1069",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1114",
        "t1480",
        "internal image",
        "brian sabey",
        "month ago",
        "modified",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "t1040",
        "sniffing",
        "t1045",
        "packing",
        "t1053",
        "taskjob"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Sova",
          "display_name": "Sova",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1022",
          "name": "Data Encrypted",
          "display_name": "T1022 - Data Encrypted"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1525",
          "name": "Implant Internal Image",
          "display_name": "T1525 - Implant Internal Image"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 956,
        "FileHash-SHA1": 906,
        "FileHash-SHA256": 2651,
        "URL": 4450,
        "domain": 708,
        "hostname": 2403,
        "CVE": 1,
        "email": 5
      },
      "indicator_count": 12080,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68abf66e97031d0ff0c04fed",
      "name": "Packed sentient.industries links to a targets business website",
      "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
      "modified": "2025-09-24T04:04:05.604000",
      "created": "2025-08-25T05:36:46.327000",
      "tags": [
        "moved",
        "body",
        "x cache",
        "cloudfront x",
        "cph50 c2",
        "certificate",
        "record value",
        "title",
        "h1 center",
        "server",
        "redacted for",
        "servers",
        "name redacted",
        "for privacy",
        "name servers",
        "org data",
        "privacy city",
        "privacy country",
        "ca creation",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "asn as57033",
        "less whois",
        "registrar",
        "tucows domains",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl ecc",
        "domain secure",
        "site ca",
        "validity",
        "subject public",
        "extraction",
        "data upload",
        "extra data",
        "include review",
        "find",
        "failed",
        "typ no",
        "ms windows",
        "intel",
        "pe32",
        "united",
        "search",
        "as16509",
        "from win32bios",
        "show",
        "high",
        "medium",
        "delphi",
        "copy",
        "write",
        "launcher",
        "next",
        "present aug",
        "present jul",
        "lowfi",
        "win32",
        "a div",
        "div div",
        "learn xml",
        "babylon",
        "win64",
        "trojan",
        "colors",
        "python",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "et info",
        "tls handshake",
        "bad traffic",
        "failure",
        "date",
        "august",
        "hybrid",
        "general",
        "path",
        "starfield",
        "click",
        "strings",
        "se bethseda",
        "n bethseda",
        "n data",
        "error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results aug",
        "read c",
        "tlsv1",
        "port",
        "destination",
        "module load",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "cname",
        "aaaa",
        "creation date",
        "showing",
        "domain",
        "dga domains",
        "palantirfoundry",
        "foundry",
        "status",
        "unknown ns",
        "g2 tls",
        "rsa sha256",
        "italy unknown",
        "mtb may",
        "trojandropper",
        "invalid url",
        "next associated",
        "ddos",
        "body html",
        "hacktool",
        "ipv4",
        "url analysis",
        "ukraine",
        "encrypt",
        "rl add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present jun",
        "entries",
        "title error",
        "all ipv4",
        "reverse dns",
        "yara detections",
        "top source",
        "top destination",
        "source source",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "canada unknown",
        "content type",
        "javascript src",
        "script script",
        "x powered",
        "ipv4 add",
        "pulse submit",
        "submit url",
        "analysis",
        "url add",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "unknown aaaa",
        "ascii text",
        "user agent",
        "powershell",
        "agent",
        "czechia unknown",
        "domain add",
        "dynamicloader",
        "hostname add",
        "pentagon",
        "defense"
      ],
      "references": [
        "sentient.industries affects independent artists. Affects several others.",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Remotewd.com devices",
        "If you find anything interesting please research it."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "nUFS_inno",
          "display_name": "nUFS_inno",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious",
          "target": null
        },
        {
          "id": "ALF:JASYP:PUA:Win32/Bibado",
          "display_name": "ALF:JASYP:PUA:Win32/Bibado",
          "target": null
        },
        {
          "id": "Trojan:Win32/Toga",
          "display_name": "Trojan:Win32/Toga",
          "target": "/malware/Trojan:Win32/Toga"
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-149",
          "display_name": "Win.Trojan.Jorik-149",
          "target": null
        },
        {
          "id": "#LowFiDetectsVmWare",
          "display_name": "#LowFiDetectsVmWare",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-130",
          "display_name": "Win.Trojan.Jorik-130",
          "target": null
        },
        {
          "id": "Win.Trojan.Fakecodecs-119",
          "display_name": "Win.Trojan.Fakecodecs-119",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Bulz-9860169-0",
          "display_name": "Win.Trojan.Bulz-9860169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop.V!MTB",
          "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
          "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Win.Packed.Razy-9785185-0",
          "display_name": "Win.Packed.Razy-9785185-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "PWS",
          "display_name": "PWS",
          "target": null
        },
        {
          "id": "DDOS:Win32/Stormser.A",
          "display_name": "DDOS:Win32/Stormser.A",
          "target": "/malware/DDOS:Win32/Stormser.A"
        },
        {
          "id": "ALF:HSTR:DotNET",
          "display_name": "ALF:HSTR:DotNET",
          "target": null
        },
        {
          "id": "DotNET",
          "display_name": "DotNET",
          "target": null
        },
        {
          "id": "Script Exploit",
          "display_name": "Script Exploit",
          "target": null
        },
        {
          "id": "HackTool:Win32/AutoKMS",
          "display_name": "HackTool:Win32/AutoKMS",
          "target": "/malware/HackTool:Win32/AutoKMS"
        },
        {
          "id": "Xanfpezes.A",
          "display_name": "Xanfpezes.A",
          "target": null
        },
        {
          "id": "Trojan:Win32/Gandcrab",
          "display_name": "Trojan:Win32/Gandcrab",
          "target": "/malware/Trojan:Win32/Gandcrab"
        },
        {
          "id": "Win.Trojan.Generic-9862772-0",
          "display_name": "Win.Trojan.Generic-9862772-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBL!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
        },
        {
          "id": "Win32/Nemucod",
          "display_name": "Win32/Nemucod",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "target": null
        },
        {
          "id": "Trojan:Win32/Blihan.A",
          "display_name": "Trojan:Win32/Blihan.A",
          "target": "/malware/Trojan:Win32/Blihan.A"
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "Win.Malware.Kolab-9885903-0",
          "display_name": "Win.Malware.Kolab-9885903-0",
          "target": null
        },
        {
          "id": "Win.Malware (30)",
          "display_name": "Win.Malware (30)",
          "target": null
        },
        {
          "id": "Ransom",
          "display_name": "Ransom",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "target": null
        },
        {
          "id": "E5",
          "display_name": "E5",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 6232,
        "URL": 24908,
        "hostname": 7993,
        "FileHash-SHA256": 11128,
        "email": 6,
        "FileHash-MD5": 1054,
        "FileHash-SHA1": 932,
        "SSLCertFingerprint": 14,
        "CIDR": 3,
        "CVE": 3
      },
      "indicator_count": 52273,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "207 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68923ea4efbf58b7ba48acec",
      "name": "Hosted App",
      "description": "",
      "modified": "2025-09-04T16:03:17.037000",
      "created": "2025-08-05T17:25:56.454000",
      "tags": [
        "issuer wr3",
        "log id",
        "gmtn",
        "abn timestamp",
        "ad180b80",
        "full name",
        "extensionsstr",
        "web server",
        "ca issuers",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "mitre att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "show technique",
        "date",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "flag",
        "usa windows",
        "hwp support",
        "march",
        "december",
        "united",
        "markmonitor",
        "overview dns",
        "requests domain",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "t1179 hooking",
        "access windows",
        "installs",
        "control att",
        "found",
        "development att",
        "name server",
        "show process",
        "programfiles",
        "command decode",
        "suricata ipv4",
        "ck matrix",
        "comspec",
        "model",
        "general",
        "dynamicloader",
        "unknown",
        "as16509",
        "whitelisted",
        "medium",
        "write c",
        "as15169",
        "search",
        "high",
        "write",
        "android",
        "malware",
        "copy",
        "next",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "site",
        "neue",
        "ipv4",
        "pulse pulses",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "refer",
        "present dec",
        "epub",
        "present jan",
        "present nov",
        "present oct",
        "showing",
        "urls show",
        "win32",
        "win64",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "prefetch8",
        "localappdata",
        "prefetch1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3409,
        "hostname": 4127,
        "URL": 8408,
        "SSLCertFingerprint": 9,
        "FileHash-SHA256": 1175,
        "FileHash-MD5": 144,
        "FileHash-SHA1": 134,
        "CVE": 2
      },
      "indicator_count": 17408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68596260a9ca6c4cc92ca068",
      "name": "Delete service | Affects Threat Research Platforms",
      "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
      "modified": "2025-08-20T04:13:22.641000",
      "created": "2025-06-23T14:19:12.328000",
      "tags": [
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "oc0006",
        "get http",
        "resolved ips",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ip address",
        "country name",
        "cname",
        "port",
        "accept",
        "gmt ifnonematch",
        "url data",
        "icmp",
        "mutexes nothing",
        "data",
        "datacrashpad",
        "edge",
        "created",
        "nothing",
        "html internet",
        "html document",
        "ascii text",
        "gtmkvjvztk dl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2401,
        "URL": 5856,
        "FileHash-SHA256": 3473,
        "domain": 2188,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 120,
        "CVE": 2
      },
      "indicator_count": 14163,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18de7177474b759ab2b7",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:10.608000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18d829739be014393c59",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:04.872000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6875e98438889e51b3fdd18f",
      "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch",
      "description": "",
      "modified": "2025-08-14T05:04:16.839000",
      "created": "2025-07-15T05:39:16.652000",
      "tags": [
        "win32 exe",
        "country",
        "include review",
        "exclude",
        "defense evasion",
        "access ta0006",
        "command",
        "control ta0011",
        "impact ta0040",
        "impact ob0008",
        "file system",
        "system oc0008",
        "match unknown",
        "adversaries",
        "match info",
        "info",
        "execution flow",
        "t1574 dll",
        "tries",
        "registry",
        "modify system",
        "process t1543",
        "unknown",
        "window",
        "ob0009 install",
        "ob0012 install",
        "insecure",
        "b0047 modify",
        "registry e1112",
        "hidden files",
        "registry run",
        "keys",
        "startup folder",
        "f0012 file",
        "critical",
        "united",
        "as15169",
        "delete c",
        "as16509",
        "show",
        "search",
        "intel",
        "ms windows",
        "entries",
        "medium",
        "worm",
        "copy",
        "write",
        "explorer",
        "malware",
        "next",
        "present jul",
        "status",
        "date",
        "ip address",
        "domain",
        "servers",
        "showing",
        "unknown ns",
        "related pulses",
        "pulses",
        "tags",
        "related tags",
        "more file",
        "type",
        "date april",
        "am size",
        "sha1 sha256",
        "as14618",
        "united kingdom",
        "as54113",
        "as15133 verizon",
        "top source",
        "top destination",
        "status domain",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "source source",
        "oamazon",
        "cnamazon rsa",
        "odigicert inc",
        "sweden as20940",
        "as20940",
        "entries tls",
        "ip destination",
        "encrypt",
        "aaaa",
        "found",
        "certificate",
        "next associated",
        "urls show",
        "date checked",
        "error",
        "windows",
        "high",
        "yara detections",
        "installs",
        "checks",
        "filehash",
        "sha256 add",
        "themida",
        "data upload",
        "extraction",
        "md5 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "win32",
        "ddos",
        "passive dns",
        "activity",
        "checkin",
        "win64",
        "mtb jan",
        "lowfi",
        "trojan",
        "ransom",
        "trojandropper",
        "yara",
        "nsis",
        "nss bv",
        "su data",
        "windo alerts",
        "andariel",
        "malware traffic",
        "nids",
        "icmp traffic",
        "dns query",
        "id deadhost",
        "connects",
        "andariel high",
        "richhash",
        "external",
        "virustotal api",
        "screenshots",
        "failed",
        "auurtonany data",
        "themida andarie",
        "present may",
        "japan unknown",
        "unknown cname",
        "domain add",
        "urls",
        "files",
        "http headers",
        "msie",
        "windows nt",
        "tcp syn",
        "resolverror",
        "externalport",
        "internalport",
        "wget command",
        "devices home",
        "execution",
        "foundry",
        "home networks",
        "mirai",
        "x.com",
        "porn",
        "monitored target",
        "d link",
        "targets"
      ],
      "references": [
        "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}",
        "Crowdsourced Signa: Schedule system process by Joe Security",
        "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel",
        "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)",
        "Yara \u2022  NSIS from ruleset NSIS by kevoreilly",
        "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security",
        "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command",
        "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI",
        "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0",
        "*Themida_2xx. Oreans,Technologies",
        "*Andariel Backdoor Activity (Checkin)",
        "Alert: dead_host nids_malware_alert network_icmp nolookup_communication",
        "IDS: WGET Command Specifying Output in HTTP Headers",
        "IDS: D-Link Devices Home Network Administration Protocol Command Execution",
        "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl",
        "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com",
        "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios",
        "Devices remotely connected, tracked , monitored"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Unix.Trojan.Mirai-6981169-0",
          "display_name": "Unix.Trojan.Mirai-6981169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Ursu-9856871-0",
          "display_name": "Win.Malware.Ursu-9856871-0",
          "target": null
        },
        {
          "id": "ELF:DDoS-Y\\ [Trj]",
          "display_name": "ELF:DDoS-Y\\ [Trj]",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 448,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 5851,
        "hostname": 2580,
        "domain": 1176,
        "URL": 7133,
        "SSLCertFingerprint": 30,
        "email": 3,
        "CVE": 3
      },
      "indicator_count": 17659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://test.mccune.ca",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://test.mccune.ca",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639068.913971
}