{
  "type": "URL",
  "indicator": "https://www.betterpropaganda.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.betterpropaganda.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3407345575,
      "indicator": "https://www.betterpropaganda.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 13,
      "pulses": [
        {
          "id": "682f52de68ac467c666c8ee0",
          "name": "23.219.89.169  dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
          "description": "https://www.virustotal.com/gui/file/191475f518a3563c8bbe32e742cc9106c0c968e2e3b9ce12aa12b5f018cbac42/relations\nhttps://www.virustotal.com/gui/ip-address/23.219.89.169/relations",
          "modified": "2025-06-21T16:02:45.537000",
          "created": "2025-05-22T16:37:50.568000",
          "tags": [
            "trojan",
            "virus",
            "md5 time",
            "action payload",
            "type malicious",
            "trojan injector",
            "trojan zloader",
            "adware",
            "parent",
            "diff",
            "drop",
            "trustcor",
            "vhash",
            "ssdeep"
          ],
          "references": [
            "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
            "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
            "svc.ha-teams.office.com",
            "s-0005.dual-s-msedge.net",
            "mira-tmc.tm-4.office.com",
            "ecs-office.s-0005.dual-s-msedge.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 63,
            "FileHash-SHA256": 451,
            "FileHash-MD5": 200,
            "hostname": 639,
            "domain": 109,
            "URL": 572
          },
          "indicator_count": 2034,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "302 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6774a3ec9b253daddfc902a3",
          "name": "Sample_5adcc978b45f6a54af936c48.exe  MD5 1f37eebe61bc9252bd72e643f4223896",
          "description": "Names\n1f37eebe61bc9252bd72e643f4223896\nSample_5adcc978b45f6a54af936c48.exe\nAutoTRON.exe\nc28961e7a22e2d5c5bce189214974a91faa11275\n17abbc9e2cd58563aba1d2f3ceb539eced16ec950ddcc3f8e068f9d0c5441096._exe",
          "modified": "2025-01-31T02:00:02.600000",
          "created": "2025-01-01T02:09:48.512000",
          "tags": [
            "sha256",
            "pejzasz",
            "wersja pliku",
            "v2 dokument",
            "tekst ascii",
            "z terminatorami",
            "crlf",
            "tekst w",
            "ascii",
            "zgodny z",
            "user",
            "settings",
            "autoit",
            "sangfor zsand",
            "tencent habo",
            "zenbox",
            "rules not",
            "c2 server",
            "memory pattern",
            "analysis date",
            "malware",
            "stealer",
            "ransom",
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 75,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 144,
            "URL": 260,
            "domain": 51,
            "hostname": 110
          },
          "indicator_count": 642,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "443 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85faa9b8e3e1206d7f25c",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
          "description": "",
          "modified": "2024-06-15T04:39:29.943000",
          "created": "2024-01-30T02:32:10.210000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3503,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28413,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "673 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cdac3ba9d7f42c0ed9c46d",
          "name": "Emotet | POD 18447 for Cox.xls | M. Brian Sabey \u2022 HallRender \u2022 Denver",
          "description": "Researchers have identified the source of a virus that has spread around the world and is believed to be linked to a network called \"thedevilsback\" in the United States, which is currently under the control of Amazon.com.",
          "modified": "2024-03-16T05:00:42.461000",
          "created": "2024-02-15T06:16:27.967000",
          "tags": [
            "dns resolutions",
            "ip traffic",
            "hashes",
            "file type",
            "name file",
            "ip detections",
            "country",
            "search",
            "zbot type",
            "indicator role",
            "active related",
            "filehashsha256",
            "entries",
            "brian sabey",
            "ssl certificate",
            "contacted",
            "resolutions",
            "communicating",
            "referrer",
            "emotet emotet",
            "malware emotet",
            "http",
            "emotet",
            "whois record",
            "contacted urls",
            "bundled",
            "threat roundup",
            "historical ssl",
            "execution",
            "attack",
            "probe",
            "service",
            "startpage",
            "core",
            "hiddentear",
            "guid",
            "ransomexx",
            "azorult",
            "lightning",
            "ursnif",
            "agent tesla",
            "quasar",
            "trickbot",
            "project",
            "remcos",
            "evilnum",
            "asyncrat",
            "matanbuchus",
            "cobalt strike",
            "metro",
            "intel",
            "ms windows",
            "pe32",
            "show",
            "trojan",
            "copy",
            "windows",
            "read",
            "write",
            "february",
            "delphi",
            "win32",
            "ransomware",
            "united",
            "unknown",
            "as44273 host",
            "moved",
            "passive dns",
            "gmt content",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "body",
            "date",
            "encrypt",
            "trojandropper",
            "ipv4",
            "virtool",
            "junkpoly",
            "worm",
            "msie",
            "chrome",
            "status",
            "creation date",
            "servers",
            "record value",
            "javascript",
            "please",
            "june",
            "august",
            "malware",
            "whois whois",
            "njrat",
            "ransomware",
            "siblings domain",
            "tulach",
            "hallrender",
            "cyber espionage",
            "cyberstalking"
          ],
          "references": [
            "POD 18447 for Cox.xls",
            "https://apps.apple.com/us/app/gambinos-pizza/id1500338496",
            "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed",
            "1.download.windowsupdate.com [HiddenTear]",
            "https://tulach.cc/ \u2022 tulach.cc \u2022 thedevilsback.golf \u2022 nextcloud.tulach.cc  [phishing]",
            "https://gronthoghor.com/xoe/qbot.zip \u2022",
            "Win32:JunkPoly - Worm:Win32/Bagle.gen!C https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.metrobyt-mobile.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Antavmu.D",
              "display_name": "Trojan:Win32/Antavmu.D",
              "target": "/malware/Trojan:Win32/Antavmu.D"
            },
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "ZBot",
              "display_name": "ZBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Delphi",
              "display_name": "Delphi",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 58,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5573,
            "hostname": 1806,
            "FileHash-SHA256": 5748,
            "domain": 1677,
            "FileHash-MD5": 349,
            "FileHash-SHA1": 348,
            "CVE": 3,
            "email": 3
          },
          "indicator_count": 15507,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "764 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cdac46a01234da94a42565",
          "name": "Emotet | POD 18447 for Cox.xls | M. Brian Sabey \u2022 HallRender \u2022 Denver",
          "description": "Researchers have identified the source of a virus that has spread around the world and is believed to be linked to a network called \"thedevilsback\" in the United States, which is currently under the control of Amazon.com.",
          "modified": "2024-03-16T05:00:42.461000",
          "created": "2024-02-15T06:16:38.290000",
          "tags": [
            "dns resolutions",
            "ip traffic",
            "hashes",
            "file type",
            "name file",
            "ip detections",
            "country",
            "search",
            "zbot type",
            "indicator role",
            "active related",
            "filehashsha256",
            "entries",
            "brian sabey",
            "ssl certificate",
            "contacted",
            "resolutions",
            "communicating",
            "referrer",
            "emotet emotet",
            "malware emotet",
            "http",
            "emotet",
            "whois record",
            "contacted urls",
            "bundled",
            "threat roundup",
            "historical ssl",
            "execution",
            "attack",
            "probe",
            "service",
            "startpage",
            "core",
            "hiddentear",
            "guid",
            "ransomexx",
            "azorult",
            "lightning",
            "ursnif",
            "agent tesla",
            "quasar",
            "trickbot",
            "project",
            "remcos",
            "evilnum",
            "asyncrat",
            "matanbuchus",
            "cobalt strike",
            "metro",
            "intel",
            "ms windows",
            "pe32",
            "show",
            "trojan",
            "copy",
            "windows",
            "read",
            "write",
            "february",
            "delphi",
            "win32",
            "ransomware",
            "united",
            "unknown",
            "as44273 host",
            "moved",
            "passive dns",
            "gmt content",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "body",
            "date",
            "encrypt",
            "trojandropper",
            "ipv4",
            "virtool",
            "junkpoly",
            "worm",
            "msie",
            "chrome",
            "status",
            "creation date",
            "servers",
            "record value",
            "javascript",
            "please",
            "june",
            "august",
            "malware",
            "whois whois",
            "njrat",
            "ransomware",
            "siblings domain",
            "tulach",
            "hallrender",
            "cyber espionage",
            "cyberstalking"
          ],
          "references": [
            "POD 18447 for Cox.xls",
            "https://apps.apple.com/us/app/gambinos-pizza/id1500338496",
            "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed",
            "1.download.windowsupdate.com [HiddenTear]",
            "https://tulach.cc/ \u2022 tulach.cc \u2022 thedevilsback.golf \u2022 nextcloud.tulach.cc  [phishing]",
            "https://gronthoghor.com/xoe/qbot.zip \u2022",
            "Win32:JunkPoly - Worm:Win32/Bagle.gen!C https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.metrobyt-mobile.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Antavmu.D",
              "display_name": "Trojan:Win32/Antavmu.D",
              "target": "/malware/Trojan:Win32/Antavmu.D"
            },
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "ZBot",
              "display_name": "ZBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Delphi",
              "display_name": "Delphi",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5573,
            "hostname": 1806,
            "FileHash-SHA256": 5748,
            "domain": 1677,
            "FileHash-MD5": 349,
            "FileHash-SHA1": 348,
            "CVE": 3,
            "email": 3
          },
          "indicator_count": 15507,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "764 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659719b77c383c73c05208a9",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-04T20:48:55.431000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e6e042a968005f7a5552",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-17T14:40:32.084000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc13594cf21dbe00b94807",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-02-01T21:55:37.581000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b85faa9b8e3e1206d7f25c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708db0c7b19b62c501601b",
          "name": "DDOS Attack",
          "description": "",
          "modified": "2023-12-06T15:05:20.038000",
          "created": "2023-12-06T15:05:20.038000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 182,
            "FileHash-SHA256": 519,
            "domain": 190,
            "URL": 528,
            "FileHash-SHA1": 2
          },
          "indicator_count": 1421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708a0bc7609ce090cb33e5",
          "name": "lapsus known associations",
          "description": "",
          "modified": "2023-12-06T14:49:47.058000",
          "created": "2023-12-06T14:49:47.058000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 182,
            "FileHash-SHA256": 519,
            "domain": 190,
            "URL": 528,
            "FileHash-SHA1": 2
          },
          "indicator_count": 1421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "627b806be644fbc56410ea90",
          "name": "DDOS Attack",
          "description": "",
          "modified": "2022-05-11T09:22:51.290000",
          "created": "2022-05-11T09:22:51.290000",
          "tags": [
            "soap-demo.xyz",
            "associations",
            "lapsus"
          ],
          "references": [
            "soap-demo.xyz"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "623d1ab277bbaca57464872b",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ALSHOBAKI",
            "id": "192458",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 519,
            "hostname": 182,
            "domain": 190,
            "URL": 528,
            "FileHash-SHA1": 2
          },
          "indicator_count": 1421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 42,
          "modified_text": "1439 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "623d1ab277bbaca57464872b",
          "name": "lapsus known associations",
          "description": "",
          "modified": "2022-04-24T00:01:15.470000",
          "created": "2022-03-25T01:28:18.545000",
          "tags": [
            "soap-demo.xyz",
            "associations",
            "lapsus"
          ],
          "references": [
            "soap-demo.xyz"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 519,
            "hostname": 182,
            "domain": 190,
            "URL": 528,
            "FileHash-SHA1": 2
          },
          "indicator_count": 1421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1457 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "1.116.217.151 [Cobalt Strike]",
        "svc.ha-teams.office.com",
        "https://gronthoghor.com/xoe/qbot.zip \u2022",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://tulach.cc/ \u2022 tulach.cc \u2022 thedevilsback.golf \u2022 nextcloud.tulach.cc  [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
        "Win32:JunkPoly - Worm:Win32/Bagle.gen!C https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.metrobyt-mobile.com",
        "dvd-game-new-releases.info",
        "ns3.hallgrandsale.ru",
        "https://tulach.cc/",
        "soap-demo.xyz",
        "POD 18447 for Cox.xls",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "s-0005.dual-s-msedge.net",
        "https://www.myminiweb.com/",
        "1.download.windowsupdate.com [HiddenTear]",
        "mira-tmc.tm-4.office.com",
        "https://apps.apple.com/us/app/gambinos-pizza/id1500338496",
        "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed",
        "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
        "vtbehaviour.commondatastorage.googleapis.com",
        "ecs-office.s-0005.dual-s-msedge.net",
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Zbot",
            "Delphi",
            "Et",
            "Cobalt strike",
            "Emotet",
            "Qbot",
            "Tulach",
            "Hiddentear",
            "Hallrender",
            "Trojan:win32/antavmu.d",
            "Hallgrand",
            "Content reputation"
          ],
          "industries": [],
          "unique_indicators": 60232
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/betterpropaganda.com",
    "whois": "http://whois.domaintools.com/betterpropaganda.com",
    "domain": "betterpropaganda.com",
    "hostname": "www.betterpropaganda.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 13,
  "pulses": [
    {
      "id": "682f52de68ac467c666c8ee0",
      "name": "23.219.89.169  dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
      "description": "https://www.virustotal.com/gui/file/191475f518a3563c8bbe32e742cc9106c0c968e2e3b9ce12aa12b5f018cbac42/relations\nhttps://www.virustotal.com/gui/ip-address/23.219.89.169/relations",
      "modified": "2025-06-21T16:02:45.537000",
      "created": "2025-05-22T16:37:50.568000",
      "tags": [
        "trojan",
        "virus",
        "md5 time",
        "action payload",
        "type malicious",
        "trojan injector",
        "trojan zloader",
        "adware",
        "parent",
        "diff",
        "drop",
        "trustcor",
        "vhash",
        "ssdeep"
      ],
      "references": [
        "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
        "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
        "svc.ha-teams.office.com",
        "s-0005.dual-s-msedge.net",
        "mira-tmc.tm-4.office.com",
        "ecs-office.s-0005.dual-s-msedge.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 63,
        "FileHash-SHA256": 451,
        "FileHash-MD5": 200,
        "hostname": 639,
        "domain": 109,
        "URL": 572
      },
      "indicator_count": 2034,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "302 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6774a3ec9b253daddfc902a3",
      "name": "Sample_5adcc978b45f6a54af936c48.exe  MD5 1f37eebe61bc9252bd72e643f4223896",
      "description": "Names\n1f37eebe61bc9252bd72e643f4223896\nSample_5adcc978b45f6a54af936c48.exe\nAutoTRON.exe\nc28961e7a22e2d5c5bce189214974a91faa11275\n17abbc9e2cd58563aba1d2f3ceb539eced16ec950ddcc3f8e068f9d0c5441096._exe",
      "modified": "2025-01-31T02:00:02.600000",
      "created": "2025-01-01T02:09:48.512000",
      "tags": [
        "sha256",
        "pejzasz",
        "wersja pliku",
        "v2 dokument",
        "tekst ascii",
        "z terminatorami",
        "crlf",
        "tekst w",
        "ascii",
        "zgodny z",
        "user",
        "settings",
        "autoit",
        "sangfor zsand",
        "tencent habo",
        "zenbox",
        "rules not",
        "c2 server",
        "memory pattern",
        "analysis date",
        "malware",
        "stealer",
        "ransom",
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 75,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 144,
        "URL": 260,
        "domain": 51,
        "hostname": 110
      },
      "indicator_count": 642,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "443 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85faa9b8e3e1206d7f25c",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
      "description": "",
      "modified": "2024-06-15T04:39:29.943000",
      "created": "2024-01-30T02:32:10.210000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3503,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28413,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "673 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cdac3ba9d7f42c0ed9c46d",
      "name": "Emotet | POD 18447 for Cox.xls | M. Brian Sabey \u2022 HallRender \u2022 Denver",
      "description": "Researchers have identified the source of a virus that has spread around the world and is believed to be linked to a network called \"thedevilsback\" in the United States, which is currently under the control of Amazon.com.",
      "modified": "2024-03-16T05:00:42.461000",
      "created": "2024-02-15T06:16:27.967000",
      "tags": [
        "dns resolutions",
        "ip traffic",
        "hashes",
        "file type",
        "name file",
        "ip detections",
        "country",
        "search",
        "zbot type",
        "indicator role",
        "active related",
        "filehashsha256",
        "entries",
        "brian sabey",
        "ssl certificate",
        "contacted",
        "resolutions",
        "communicating",
        "referrer",
        "emotet emotet",
        "malware emotet",
        "http",
        "emotet",
        "whois record",
        "contacted urls",
        "bundled",
        "threat roundup",
        "historical ssl",
        "execution",
        "attack",
        "probe",
        "service",
        "startpage",
        "core",
        "hiddentear",
        "guid",
        "ransomexx",
        "azorult",
        "lightning",
        "ursnif",
        "agent tesla",
        "quasar",
        "trickbot",
        "project",
        "remcos",
        "evilnum",
        "asyncrat",
        "matanbuchus",
        "cobalt strike",
        "metro",
        "intel",
        "ms windows",
        "pe32",
        "show",
        "trojan",
        "copy",
        "windows",
        "read",
        "write",
        "february",
        "delphi",
        "win32",
        "ransomware",
        "united",
        "unknown",
        "as44273 host",
        "moved",
        "passive dns",
        "gmt content",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "body",
        "date",
        "encrypt",
        "trojandropper",
        "ipv4",
        "virtool",
        "junkpoly",
        "worm",
        "msie",
        "chrome",
        "status",
        "creation date",
        "servers",
        "record value",
        "javascript",
        "please",
        "june",
        "august",
        "malware",
        "whois whois",
        "njrat",
        "ransomware",
        "siblings domain",
        "tulach",
        "hallrender",
        "cyber espionage",
        "cyberstalking"
      ],
      "references": [
        "POD 18447 for Cox.xls",
        "https://apps.apple.com/us/app/gambinos-pizza/id1500338496",
        "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed",
        "1.download.windowsupdate.com [HiddenTear]",
        "https://tulach.cc/ \u2022 tulach.cc \u2022 thedevilsback.golf \u2022 nextcloud.tulach.cc  [phishing]",
        "https://gronthoghor.com/xoe/qbot.zip \u2022",
        "Win32:JunkPoly - Worm:Win32/Bagle.gen!C https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.metrobyt-mobile.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Antavmu.D",
          "display_name": "Trojan:Win32/Antavmu.D",
          "target": "/malware/Trojan:Win32/Antavmu.D"
        },
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "ZBot",
          "display_name": "ZBot",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "Delphi",
          "display_name": "Delphi",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 58,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5573,
        "hostname": 1806,
        "FileHash-SHA256": 5748,
        "domain": 1677,
        "FileHash-MD5": 349,
        "FileHash-SHA1": 348,
        "CVE": 3,
        "email": 3
      },
      "indicator_count": 15507,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "764 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cdac46a01234da94a42565",
      "name": "Emotet | POD 18447 for Cox.xls | M. Brian Sabey \u2022 HallRender \u2022 Denver",
      "description": "Researchers have identified the source of a virus that has spread around the world and is believed to be linked to a network called \"thedevilsback\" in the United States, which is currently under the control of Amazon.com.",
      "modified": "2024-03-16T05:00:42.461000",
      "created": "2024-02-15T06:16:38.290000",
      "tags": [
        "dns resolutions",
        "ip traffic",
        "hashes",
        "file type",
        "name file",
        "ip detections",
        "country",
        "search",
        "zbot type",
        "indicator role",
        "active related",
        "filehashsha256",
        "entries",
        "brian sabey",
        "ssl certificate",
        "contacted",
        "resolutions",
        "communicating",
        "referrer",
        "emotet emotet",
        "malware emotet",
        "http",
        "emotet",
        "whois record",
        "contacted urls",
        "bundled",
        "threat roundup",
        "historical ssl",
        "execution",
        "attack",
        "probe",
        "service",
        "startpage",
        "core",
        "hiddentear",
        "guid",
        "ransomexx",
        "azorult",
        "lightning",
        "ursnif",
        "agent tesla",
        "quasar",
        "trickbot",
        "project",
        "remcos",
        "evilnum",
        "asyncrat",
        "matanbuchus",
        "cobalt strike",
        "metro",
        "intel",
        "ms windows",
        "pe32",
        "show",
        "trojan",
        "copy",
        "windows",
        "read",
        "write",
        "february",
        "delphi",
        "win32",
        "ransomware",
        "united",
        "unknown",
        "as44273 host",
        "moved",
        "passive dns",
        "gmt content",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "body",
        "date",
        "encrypt",
        "trojandropper",
        "ipv4",
        "virtool",
        "junkpoly",
        "worm",
        "msie",
        "chrome",
        "status",
        "creation date",
        "servers",
        "record value",
        "javascript",
        "please",
        "june",
        "august",
        "malware",
        "whois whois",
        "njrat",
        "ransomware",
        "siblings domain",
        "tulach",
        "hallrender",
        "cyber espionage",
        "cyberstalking"
      ],
      "references": [
        "POD 18447 for Cox.xls",
        "https://apps.apple.com/us/app/gambinos-pizza/id1500338496",
        "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed",
        "1.download.windowsupdate.com [HiddenTear]",
        "https://tulach.cc/ \u2022 tulach.cc \u2022 thedevilsback.golf \u2022 nextcloud.tulach.cc  [phishing]",
        "https://gronthoghor.com/xoe/qbot.zip \u2022",
        "Win32:JunkPoly - Worm:Win32/Bagle.gen!C https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.metrobyt-mobile.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Antavmu.D",
          "display_name": "Trojan:Win32/Antavmu.D",
          "target": "/malware/Trojan:Win32/Antavmu.D"
        },
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "ZBot",
          "display_name": "ZBot",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "Delphi",
          "display_name": "Delphi",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5573,
        "hostname": 1806,
        "FileHash-SHA256": 5748,
        "domain": 1677,
        "FileHash-MD5": 349,
        "FileHash-SHA1": 348,
        "CVE": 3,
        "email": 3
      },
      "indicator_count": 15507,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "764 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659719b77c383c73c05208a9",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-04T20:48:55.431000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e6e042a968005f7a5552",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-17T14:40:32.084000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc13594cf21dbe00b94807",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-02-01T21:55:37.581000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65b85faa9b8e3e1206d7f25c",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708db0c7b19b62c501601b",
      "name": "DDOS Attack",
      "description": "",
      "modified": "2023-12-06T15:05:20.038000",
      "created": "2023-12-06T15:05:20.038000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 182,
        "FileHash-SHA256": 519,
        "domain": 190,
        "URL": 528,
        "FileHash-SHA1": 2
      },
      "indicator_count": 1421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.betterpropaganda.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.betterpropaganda.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776649334.2034626
}