{
  "type": "URL",
  "indicator": "https://www.paypal.com.tr",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.paypal.com.tr",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3857241433,
      "indicator": "https://www.paypal.com.tr",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6695e27f356a22d97fba5ca8",
          "name": "Critical attack/s continues to affect YouTube Creator/s account/s",
          "description": "Related to YouTube creator/s  attack/s. Found as part of Jays Youtube Bot.exe and YouTube bots.\nFull CnC, access and id devices. Redirects views, resells. spoofs, binds and/or accounts. FRAUD! \nReference: YARA Signature Match - THOR APT Scanner\nRULE: SUSP_Wextract_Anomaly_Unsigned_May23\nRULE_SET: Livehunt - Suspicious290 Indicators \ud83c\udff9\nRULE_TYPE: THOR APT Scanner's rule set only \ud83d\udd28\nRULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_Wextract_Anomaly_Unsigned_May23\nDESCRIPTION: Detects an anomalous unsigned wextract that contains additional code and has been seen abused to deliver malware\nREFERENCE: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution/\nRULE_AUTHOR: X__Junior\nThor for details #susp_wextract_anomaly_unsigned_may23",
          "modified": "2024-08-15T02:00:24.886000",
          "created": "2024-07-16T03:01:17.316000",
          "tags": [
            "win32 exe",
            "wextract",
            "kb file",
            "files",
            "file type",
            "javascript",
            "graph",
            "ip detections",
            "country",
            "userprofile",
            "runtime modules",
            "samplepath",
            "delnoderundll32",
            "mpgph131 hr",
            "hourly rl",
            "highest c",
            "mpgph131 lg",
            "onlogon rl",
            "highest",
            "process",
            "registrya",
            "registry keys",
            "registry",
            "windows policy",
            "shell folders",
            "file execution",
            "binary data",
            "security center",
            "text c",
            "peexe c",
            "xml c",
            "zip c",
            "file system",
            "written c",
            "dropped",
            "hashes",
            "windows nt",
            "wow64",
            "referer https",
            "date thu",
            "get https",
            "request",
            "gecko response",
            "gmt connection",
            "gmt vary",
            "etag",
            "accept",
            "win64",
            "query",
            "windows get",
            "internal",
            "set file",
            "create",
            "create process",
            "windows read",
            "shutdown system",
            "modify access",
            "delete registry",
            "enumerate",
            "behavior tags",
            "k0pmbc",
            "spsfsb",
            "ctsu",
            "efq78c",
            "egw7od",
            "en3i8d",
            "i6ydgd",
            "iz1fbc",
            "izt63",
            "kum7z",
            "vs2003",
            "sp1 build",
            "contained",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "simplified",
            "army",
            "variant sides",
            "with russia",
            "ramnit",
            "netsupport rat",
            "sneaky server",
            "replacement",
            "unauthorized",
            "sim unlock",
            "emotet",
            "chaos",
            "malicious",
            "critical",
            "copy",
            "life",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "cc linker",
            "urls",
            "gandi sas",
            "domains",
            "cloudflare",
            "ii llc",
            "psiusa",
            "domain robot",
            "ltd dba",
            "com laude",
            "ascio",
            "contacted",
            "ms word",
            "document",
            "b file",
            "html",
            "javascript jac",
            "html iu3",
            "executed by usa",
            "#wextract",
            "#unsigned",
            "thor",
            "stealer",
            "evader",
            "systemroot",
            "grum",
            "high",
            "delete c",
            "cape",
            "write",
            "103 read",
            "clsid read",
            "date read",
            "trojan",
            "united",
            "unknown",
            "status",
            "cname",
            "creation date",
            "search",
            "as1921",
            "austria unknown",
            "emails",
            "expiration date",
            "date",
            "pragma",
            "next",
            "passive dns",
            "backdoor",
            "win32",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "usa",
            "co",
            "teams",
            "cybercrime",
            "spoof",
            "benjamin",
            "dynamicloader",
            "write c",
            "pe32 executable",
            "show",
            "yara rule",
            "windows",
            "recon",
            "worm",
            "powershell",
            "june",
            "delphi",
            "malware",
            "malice",
            "retaliation",
            "through the nights",
            "apple",
            "lenovo",
            "ios",
            "hackers",
            "move",
            "moved"
          ],
          "references": [
            "WEXTRACT.EXE .MUI: FileHash-SHA256 00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4",
            "MALWARE STEALER TROJAN EVADER | WEXTRACT.EXE .MUI | TXTRESSE | via https://www.virustotal.com/gui/domain/www.youtube.com",
            "CS Sigma: Matches rule Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke",
            "Critical CS Sigma: Matches rule Suspicious Double Extension File Execution by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)",
            "^ by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) ^",
            "CS Sigma: Matches rule Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, J\u00e1n Tren\u010dansk\u00fd, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan",
            "CS Sigma: Matches rule Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)",
            "CS Sigma: Matches rule Suspicious Add Scheduled Task Parent by Florian Roth (Nextron Systems)",
            "CS Sigma: Matches rule Suspicious Schtasks Schedule Type With High Privileges by Nasreddine Bencherchali (Nextron Systems)",
            "CS Sigma: Matches rule Scheduled Task Creation by Florian Roth (Nextron Systems)",
            "CS IDS: Matches rule (stream_tcp) data sent on stream not accepting data",
            "CS IDS: Matches rule (http_inspect) HTTP response has UTF character set that failed to normalize",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration)",
            "CS IDS: Matches rule ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)",
            "CS IDS: Matches rule ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token)  Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP)",
            "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Activity)",
            "CS IDS: Matches rule ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent",
            "CS IDS: Matches rule ET MALWARE Suspected RisePro TCP Heartbeat Packet",
            "CS IDS: Matches rule ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)",
            "CS IDS: Matches rule ET MALWARE Win32/Ramnit Checkin Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "TXTRESSE: FileHash-SHA256 00001dd58b69582cc30a16b000bce3d96d369487444385489084719676afba4d",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "Crowdsourced YARA rules: Matches rule win_ramnit_auto from ruleset win.ramnit_auto by Felix Bilstein - yara-signator at cocacoding dot com",
            "Crowdsourced YARA rules: Matches rule MAL_Ramnit_May19_1 from ruleset crime_nansh0u by Florian Roth (Nextron Systems)",
            "Crowdsourced IDS rules: Matches rule: MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "Crowdsourced IDS rules: Matches rule: (port_scan) UDP filtered",
            "Crowdsourced IDS rules: Matches rule: ET MALWARE Win32/Ramnit Checkin | Matches rule ET DNS Query for .cc TLD",
            "https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "TrojanDownloader:Win32/Upatre ,  Virus:Win32/Sality.AT , Win.Downloader.Small-1645",
            "Antivirus Detections: Backdoor:Win32/Likseput.B ,  PWS:Win32/QQpass.B!MTB ,  Trojan:Win32/Scrarev.C ,  Trojan:Win32/Speesipro.A ,  Trojan:Win32/Zombie.A ,  TrojanDownloader:Win32/Cutwail.BS ,  TrojanDownloader:Win32/Nemucod ,",
            "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Backdoor.Win32.Pushdo.s Checkin Suspicious csrss.exe in URI",
            "https://www.virustotal.com/gui/file/00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4/detection",
            "Jays Youtube Bot.exe > FileHash-SHA256 00514527e00ee001d042",
            "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2",
            "https://www.youtube.com/watch?v=GyuMozsVyYs",
            "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"",
            "https://otx.alienvault.com/pulse/6694bb9be1b61bf820500004",
            "http://193.233.132.62/hera/amadka.exe | https://www.info-only-men.com/landing/mlp88g?subPublisher=popunder:eu-adsrv.rtbsuperhub.com&zone=popunder:eu-adsrv.rtbsuperhub.com&",
            "https://software-free-phone-2018.win/62ae8f9b-d0cb-4b4c-8318-dd7900e1d092/e29481e9-a792-46a8-bbf0-188ed2a816ae/?brand=Apple&browser=Safari&btd=dHJr",
            "nr-data.net [Apple Private Data Collection]",
            "https://rector-fitiology.icu/99c8d3a6-be16-421a-87a8-40701eae8149?zoneid=6543079&bannerid=18710758&browser=chrome&os=ios&devic",
            "https://software-free-phone-2018.win/7a7c1101-0538-49de-925f-4f4675a5fd1f/3b0669f6-a07e-4eb8-8e2b-d0282d482c1a/?brand=Lenovo&browser=Chr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WAT:Blacked-E",
              "display_name": "WAT:Blacked-E",
              "target": null
            },
            {
              "id": "Win32:RmnDrp [Inf]",
              "display_name": "Win32:RmnDrp [Inf]",
              "target": null
            },
            {
              "id": "AI:FileInfector.EAEEA7850C",
              "display_name": "AI:FileInfector.EAEEA7850C",
              "target": null
            },
            {
              "id": "Virus.Ramnit/Nimnul",
              "display_name": "Virus.Ramnit/Nimnul",
              "target": null
            },
            {
              "id": "Trojan.Crifi.1",
              "display_name": "Trojan.Crifi.1",
              "target": null
            },
            {
              "id": "Trojan.MSIL.Injurer.cbd",
              "display_name": "Trojan.MSIL.Injurer.cbd",
              "target": null
            },
            {
              "id": "Win.Downloader.Small-1645",
              "display_name": "Win.Downloader.Small-1645",
              "target": null
            },
            {
              "id": "Trojan:Win32/Scrarev.C",
              "display_name": "Trojan:Win32/Scrarev.C",
              "target": "/malware/Trojan:Win32/Scrarev.C"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Trojan:Win32/Speesipro.A",
              "display_name": "Trojan:Win32/Speesipro.A",
              "target": "/malware/Trojan:Win32/Speesipro.A"
            },
            {
              "id": "Virus:Win32/Sality.AT",
              "display_name": "Virus:Win32/Sality.AT",
              "target": "/malware/Virus:Win32/Sality.AT"
            },
            {
              "id": "TrojanDownloader:Win32/Upatre",
              "display_name": "TrojanDownloader:Win32/Upatre",
              "target": "/malware/TrojanDownloader:Win32/Upatre"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail.BS",
              "display_name": "TrojanDownloader:Win32/Cutwail.BS",
              "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Backdoor:Win32/Likseput.B",
              "display_name": "Backdoor:Win32/Likseput.B",
              "target": "/malware/Backdoor:Win32/Likseput.B"
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
              "display_name": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003.007",
              "name": "Proc Filesystem",
              "display_name": "T1003.007 - Proc Filesystem"
            },
            {
              "id": "T1042",
              "name": "Change Default File Association",
              "display_name": "T1042 - Change Default File Association"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Media",
            "Technology",
            "Civil Society",
            "Crime Victims"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4312,
            "domain": 1056,
            "hostname": 1818,
            "URL": 5125,
            "FileHash-MD5": 310,
            "FileHash-SHA1": 221,
            "email": 3
          },
          "indicator_count": 12845,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "612 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f4ba867ec44a4dc0e6fc96",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
          "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-15T21:15:50.802000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980ad16123b5d52f5f76f",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
          "description": "",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-19T12:10:21.291000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65f4ba867ec44a4dc0e6fc96",
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 235,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Critical CS Sigma: Matches rule Suspicious Double Extension File Execution by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token)  Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP)",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)",
        "Antivirus Detections: Backdoor:Win32/Likseput.B ,  PWS:Win32/QQpass.B!MTB ,  Trojan:Win32/Scrarev.C ,  Trojan:Win32/Speesipro.A ,  Trojan:Win32/Zombie.A ,  TrojanDownloader:Win32/Cutwail.BS ,  TrojanDownloader:Win32/Nemucod ,",
        "CS Sigma: Matches rule Scheduled Task Creation by Florian Roth (Nextron Systems)",
        "Jays Youtube Bot.exe > FileHash-SHA256 00514527e00ee001d042",
        "CS Sigma: Matches rule Suspicious Schtasks Schedule Type With High Privileges by Nasreddine Bencherchali (Nextron Systems)",
        "CS Sigma: Matches rule Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke",
        "https://www.youtube.com/watch?v=GyuMozsVyYs",
        "WEXTRACT.EXE .MUI: FileHash-SHA256 00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4",
        "Crowdsourced YARA rules: Matches rule win_ramnit_auto from ruleset win.ramnit_auto by Felix Bilstein - yara-signator at cocacoding dot com",
        "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "Crowdsourced IDS rules: Matches rule: ET MALWARE Win32/Ramnit Checkin | Matches rule ET DNS Query for .cc TLD",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "CS Sigma: Matches rule Suspicious Add Scheduled Task Parent by Florian Roth (Nextron Systems)",
        "CS IDS: Matches rule ET MALWARE Win32/Ramnit Checkin Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Crowdsourced IDS rules: Matches rule: (port_scan) UDP filtered",
        "http://193.233.132.62/hera/amadka.exe | https://www.info-only-men.com/landing/mlp88g?subPublisher=popunder:eu-adsrv.rtbsuperhub.com&zone=popunder:eu-adsrv.rtbsuperhub.com&",
        "MALWARE STEALER TROJAN EVADER | WEXTRACT.EXE .MUI | TXTRESSE | via https://www.virustotal.com/gui/domain/www.youtube.com",
        "https://software-free-phone-2018.win/62ae8f9b-d0cb-4b4c-8318-dd7900e1d092/e29481e9-a792-46a8-bbf0-188ed2a816ae/?brand=Apple&browser=Safari&btd=dHJr",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Crowdsourced IDS rules: Matches rule: MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "https://software-free-phone-2018.win/7a7c1101-0538-49de-925f-4f4675a5fd1f/3b0669f6-a07e-4eb8-8e2b-d0282d482c1a/?brand=Lenovo&browser=Chr",
        "https://www.virustotal.com/gui/file/00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4/detection",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration)",
        "nr-data.net [Apple Private Data Collection]",
        "TXTRESSE: FileHash-SHA256 00001dd58b69582cc30a16b000bce3d96d369487444385489084719676afba4d",
        "CS IDS: Matches rule ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "^ by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) ^",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "CS IDS: Matches rule (stream_tcp) data sent on stream not accepting data",
        "https://otx.alienvault.com/pulse/6694bb9be1b61bf820500004",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Activity)",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Crowdsourced YARA rules: Matches rule MAL_Ramnit_May19_1 from ruleset crime_nansh0u by Florian Roth (Nextron Systems)",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "Self whitelisting tool, domains moved within nginx.",
        "CS Sigma: Matches rule Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, J\u00e1n Tren\u010dansk\u00fd, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan",
        "CS Sigma: Matches rule Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)",
        "CS IDS: Matches rule ET MALWARE Suspected RisePro TCP Heartbeat Packet",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Backdoor.Win32.Pushdo.s Checkin Suspicious csrss.exe in URI",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "CS IDS: Matches rule ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)",
        "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2",
        "https://rector-fitiology.icu/99c8d3a6-be16-421a-87a8-40701eae8149?zoneid=6543079&bannerid=18710758&browser=chrome&os=ios&devic",
        "CS IDS: Matches rule (http_inspect) HTTP response has UTF character set that failed to normalize",
        "TrojanDownloader:Win32/Upatre ,  Virus:Win32/Sality.AT , Win.Downloader.Small-1645",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan.crifi.1",
            "Bulz",
            "Trojanspy",
            "Wat:blacked-e",
            "Zbot",
            "Win32:rmndrp [inf]",
            "Blacknet",
            "Virus:win32/sality.at",
            "Trojandownloader:win32/cutwail.bs",
            "Trojan:win32/scrarev.c",
            "Worm:win32/benjamin",
            "Trojan:win32/speesipro.a",
            "Trojandownloader:win32/upatre",
            "Trojandownloader:win32/nemucod",
            "Maltiverse",
            "Ai:fileinfector.eaeea7850c",
            "Fragtor",
            "Pws:win32/qqpass.b!mtb",
            "Win.downloader.small-1645",
            "Trojan:win32/zombie.a",
            "Backdoor:win32/likseput.b",
            "Trojan.msil.injurer.cbd",
            "Alf:heraklezeval:trojanspy:win32/socstealer",
            "Virus.ramnit/nimnul",
            "Quasar"
          ],
          "industries": [
            "Media",
            "Crime victims",
            "Civil society",
            "Technology"
          ],
          "unique_indicators": 34335
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/paypal.com.tr",
    "whois": "http://whois.domaintools.com/paypal.com.tr",
    "domain": "paypal.com.tr",
    "hostname": "www.paypal.com.tr"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6695e27f356a22d97fba5ca8",
      "name": "Critical attack/s continues to affect YouTube Creator/s account/s",
      "description": "Related to YouTube creator/s  attack/s. Found as part of Jays Youtube Bot.exe and YouTube bots.\nFull CnC, access and id devices. Redirects views, resells. spoofs, binds and/or accounts. FRAUD! \nReference: YARA Signature Match - THOR APT Scanner\nRULE: SUSP_Wextract_Anomaly_Unsigned_May23\nRULE_SET: Livehunt - Suspicious290 Indicators \ud83c\udff9\nRULE_TYPE: THOR APT Scanner's rule set only \ud83d\udd28\nRULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_Wextract_Anomaly_Unsigned_May23\nDESCRIPTION: Detects an anomalous unsigned wextract that contains additional code and has been seen abused to deliver malware\nREFERENCE: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution/\nRULE_AUTHOR: X__Junior\nThor for details #susp_wextract_anomaly_unsigned_may23",
      "modified": "2024-08-15T02:00:24.886000",
      "created": "2024-07-16T03:01:17.316000",
      "tags": [
        "win32 exe",
        "wextract",
        "kb file",
        "files",
        "file type",
        "javascript",
        "graph",
        "ip detections",
        "country",
        "userprofile",
        "runtime modules",
        "samplepath",
        "delnoderundll32",
        "mpgph131 hr",
        "hourly rl",
        "highest c",
        "mpgph131 lg",
        "onlogon rl",
        "highest",
        "process",
        "registrya",
        "registry keys",
        "registry",
        "windows policy",
        "shell folders",
        "file execution",
        "binary data",
        "security center",
        "text c",
        "peexe c",
        "xml c",
        "zip c",
        "file system",
        "written c",
        "dropped",
        "hashes",
        "windows nt",
        "wow64",
        "referer https",
        "date thu",
        "get https",
        "request",
        "gecko response",
        "gmt connection",
        "gmt vary",
        "etag",
        "accept",
        "win64",
        "query",
        "windows get",
        "internal",
        "set file",
        "create",
        "create process",
        "windows read",
        "shutdown system",
        "modify access",
        "delete registry",
        "enumerate",
        "behavior tags",
        "k0pmbc",
        "spsfsb",
        "ctsu",
        "efq78c",
        "egw7od",
        "en3i8d",
        "i6ydgd",
        "iz1fbc",
        "izt63",
        "kum7z",
        "vs2003",
        "sp1 build",
        "contained",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "simplified",
        "army",
        "variant sides",
        "with russia",
        "ramnit",
        "netsupport rat",
        "sneaky server",
        "replacement",
        "unauthorized",
        "sim unlock",
        "emotet",
        "chaos",
        "malicious",
        "critical",
        "copy",
        "life",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "cc linker",
        "urls",
        "gandi sas",
        "domains",
        "cloudflare",
        "ii llc",
        "psiusa",
        "domain robot",
        "ltd dba",
        "com laude",
        "ascio",
        "contacted",
        "ms word",
        "document",
        "b file",
        "html",
        "javascript jac",
        "html iu3",
        "executed by usa",
        "#wextract",
        "#unsigned",
        "thor",
        "stealer",
        "evader",
        "systemroot",
        "grum",
        "high",
        "delete c",
        "cape",
        "write",
        "103 read",
        "clsid read",
        "date read",
        "trojan",
        "united",
        "unknown",
        "status",
        "cname",
        "creation date",
        "search",
        "as1921",
        "austria unknown",
        "emails",
        "expiration date",
        "date",
        "pragma",
        "next",
        "passive dns",
        "backdoor",
        "win32",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "usa",
        "co",
        "teams",
        "cybercrime",
        "spoof",
        "benjamin",
        "dynamicloader",
        "write c",
        "pe32 executable",
        "show",
        "yara rule",
        "windows",
        "recon",
        "worm",
        "powershell",
        "june",
        "delphi",
        "malware",
        "malice",
        "retaliation",
        "through the nights",
        "apple",
        "lenovo",
        "ios",
        "hackers",
        "move",
        "moved"
      ],
      "references": [
        "WEXTRACT.EXE .MUI: FileHash-SHA256 00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4",
        "MALWARE STEALER TROJAN EVADER | WEXTRACT.EXE .MUI | TXTRESSE | via https://www.virustotal.com/gui/domain/www.youtube.com",
        "CS Sigma: Matches rule Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke",
        "Critical CS Sigma: Matches rule Suspicious Double Extension File Execution by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)",
        "^ by Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) ^",
        "CS Sigma: Matches rule Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, J\u00e1n Tren\u010dansk\u00fd, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan",
        "CS Sigma: Matches rule Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)",
        "CS Sigma: Matches rule Suspicious Add Scheduled Task Parent by Florian Roth (Nextron Systems)",
        "CS Sigma: Matches rule Suspicious Schtasks Schedule Type With High Privileges by Nasreddine Bencherchali (Nextron Systems)",
        "CS Sigma: Matches rule Scheduled Task Creation by Florian Roth (Nextron Systems)",
        "CS IDS: Matches rule (stream_tcp) data sent on stream not accepting data",
        "CS IDS: Matches rule (http_inspect) HTTP response has UTF character set that failed to normalize",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration)",
        "CS IDS: Matches rule ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token)  Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP)",
        "CS IDS: Matches rule ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Activity)",
        "CS IDS: Matches rule ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent",
        "CS IDS: Matches rule ET MALWARE Suspected RisePro TCP Heartbeat Packet",
        "CS IDS: Matches rule ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)",
        "CS IDS: Matches rule ET MALWARE Win32/Ramnit Checkin Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "TXTRESSE: FileHash-SHA256 00001dd58b69582cc30a16b000bce3d96d369487444385489084719676afba4d",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "Crowdsourced YARA rules: Matches rule win_ramnit_auto from ruleset win.ramnit_auto by Felix Bilstein - yara-signator at cocacoding dot com",
        "Crowdsourced YARA rules: Matches rule MAL_Ramnit_May19_1 from ruleset crime_nansh0u by Florian Roth (Nextron Systems)",
        "Crowdsourced IDS rules: Matches rule: MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "Crowdsourced IDS rules: Matches rule: (port_scan) UDP filtered",
        "Crowdsourced IDS rules: Matches rule: ET MALWARE Win32/Ramnit Checkin | Matches rule ET DNS Query for .cc TLD",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "TrojanDownloader:Win32/Upatre ,  Virus:Win32/Sality.AT , Win.Downloader.Small-1645",
        "Antivirus Detections: Backdoor:Win32/Likseput.B ,  PWS:Win32/QQpass.B!MTB ,  Trojan:Win32/Scrarev.C ,  Trojan:Win32/Speesipro.A ,  Trojan:Win32/Zombie.A ,  TrojanDownloader:Win32/Cutwail.BS ,  TrojanDownloader:Win32/Nemucod ,",
        "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Backdoor.Win32.Pushdo.s Checkin Suspicious csrss.exe in URI",
        "https://www.virustotal.com/gui/file/00e5aefb5ffd357e995d1a4ee30735a692780b203cd58e6239637471047d51a4/detection",
        "Jays Youtube Bot.exe > FileHash-SHA256 00514527e00ee001d042",
        "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2",
        "https://www.youtube.com/watch?v=GyuMozsVyYs",
        "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"",
        "https://otx.alienvault.com/pulse/6694bb9be1b61bf820500004",
        "http://193.233.132.62/hera/amadka.exe | https://www.info-only-men.com/landing/mlp88g?subPublisher=popunder:eu-adsrv.rtbsuperhub.com&zone=popunder:eu-adsrv.rtbsuperhub.com&",
        "https://software-free-phone-2018.win/62ae8f9b-d0cb-4b4c-8318-dd7900e1d092/e29481e9-a792-46a8-bbf0-188ed2a816ae/?brand=Apple&browser=Safari&btd=dHJr",
        "nr-data.net [Apple Private Data Collection]",
        "https://rector-fitiology.icu/99c8d3a6-be16-421a-87a8-40701eae8149?zoneid=6543079&bannerid=18710758&browser=chrome&os=ios&devic",
        "https://software-free-phone-2018.win/7a7c1101-0538-49de-925f-4f4675a5fd1f/3b0669f6-a07e-4eb8-8e2b-d0282d482c1a/?brand=Lenovo&browser=Chr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WAT:Blacked-E",
          "display_name": "WAT:Blacked-E",
          "target": null
        },
        {
          "id": "Win32:RmnDrp [Inf]",
          "display_name": "Win32:RmnDrp [Inf]",
          "target": null
        },
        {
          "id": "AI:FileInfector.EAEEA7850C",
          "display_name": "AI:FileInfector.EAEEA7850C",
          "target": null
        },
        {
          "id": "Virus.Ramnit/Nimnul",
          "display_name": "Virus.Ramnit/Nimnul",
          "target": null
        },
        {
          "id": "Trojan.Crifi.1",
          "display_name": "Trojan.Crifi.1",
          "target": null
        },
        {
          "id": "Trojan.MSIL.Injurer.cbd",
          "display_name": "Trojan.MSIL.Injurer.cbd",
          "target": null
        },
        {
          "id": "Win.Downloader.Small-1645",
          "display_name": "Win.Downloader.Small-1645",
          "target": null
        },
        {
          "id": "Trojan:Win32/Scrarev.C",
          "display_name": "Trojan:Win32/Scrarev.C",
          "target": "/malware/Trojan:Win32/Scrarev.C"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Trojan:Win32/Speesipro.A",
          "display_name": "Trojan:Win32/Speesipro.A",
          "target": "/malware/Trojan:Win32/Speesipro.A"
        },
        {
          "id": "Virus:Win32/Sality.AT",
          "display_name": "Virus:Win32/Sality.AT",
          "target": "/malware/Virus:Win32/Sality.AT"
        },
        {
          "id": "TrojanDownloader:Win32/Upatre",
          "display_name": "TrojanDownloader:Win32/Upatre",
          "target": "/malware/TrojanDownloader:Win32/Upatre"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail.BS",
          "display_name": "TrojanDownloader:Win32/Cutwail.BS",
          "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "PWS:Win32/QQpass.B!MTB",
          "display_name": "PWS:Win32/QQpass.B!MTB",
          "target": "/malware/PWS:Win32/QQpass.B!MTB"
        },
        {
          "id": "Backdoor:Win32/Likseput.B",
          "display_name": "Backdoor:Win32/Likseput.B",
          "target": "/malware/Backdoor:Win32/Likseput.B"
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
          "display_name": "ALF:HeraklezEval:TrojanSpy:Win32/SocStealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1134.004",
          "name": "Parent PID Spoofing",
          "display_name": "T1134.004 - Parent PID Spoofing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003.007",
          "name": "Proc Filesystem",
          "display_name": "T1003.007 - Proc Filesystem"
        },
        {
          "id": "T1042",
          "name": "Change Default File Association",
          "display_name": "T1042 - Change Default File Association"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Media",
        "Technology",
        "Civil Society",
        "Crime Victims"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4312,
        "domain": 1056,
        "hostname": 1818,
        "URL": 5125,
        "FileHash-MD5": 310,
        "FileHash-SHA1": 221,
        "email": 3
      },
      "indicator_count": 12845,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "612 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f4ba867ec44a4dc0e6fc96",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
      "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-15T21:15:50.802000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "736 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980ad16123b5d52f5f76f",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
      "description": "",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-19T12:10:21.291000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65f4ba867ec44a4dc0e6fc96",
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 235,
      "modified_text": "736 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.paypal.com.tr",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.paypal.com.tr",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642317.48309
}