{
  "type": "URL",
  "indicator": "https://www.vaslam.xyz",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.vaslam.xyz",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833397125,
      "indicator": "https://www.vaslam.xyz",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 11,
      "pulses": [
        {
          "id": "69d3532c76eb3bf5edd9609b",
          "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
          "description": "",
          "modified": "2026-04-06T06:31:08.181000",
          "created": "2026-04-06T06:31:08.181000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65bbb998c3b7662e5059b6c2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "58 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d3532a6537880f6e2c68dc",
          "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
          "description": "",
          "modified": "2026-04-06T06:31:06.730000",
          "created": "2026-04-06T06:31:06.730000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65bbb998c3b7662e5059b6c2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "58 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c3bd803f15cd94aab6e287",
          "name": "Lumma Stealer | Colorado Medical Center HCA",
          "description": "Needs further investigation. Miscellaneous attack affecting Denver physicians directory. Visitors accessing the page using insecure devices may be affected. PII & PHI breached. Monitoring.",
          "modified": "2024-03-08T17:04:03.644000",
          "created": "2024-02-07T17:27:28.349000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "resolutions",
            "problems",
            "siblings domain",
            "whois whois",
            "startpage",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "language",
            "html document",
            "unicode text",
            "utf8 text",
            "doctype",
            "anchor hrefs",
            "hrefs",
            "denver",
            "tsara brashears",
            "apple ios",
            "password bypass",
            "apple phone",
            "unlocker",
            "shell code",
            "script",
            "contacted urls",
            "hacktool",
            "malicious",
            "download",
            "malware",
            "relic",
            "monitoring",
            "domains",
            "eurodns sa",
            "markmonitor",
            "ip detections",
            "country",
            "graph",
            "https",
            "mitre att",
            "ta0007 network",
            "t1046 sends",
            "ssdp",
            "command",
            "control ta0011",
            "protocol t1071",
            "performs dns",
            "layer protocol",
            "number",
            "cus cndigicert",
            "ja3s",
            "subject",
            "sha2 secure",
            "server ca",
            "odigicert inc",
            "cus cnmicrosoft",
            "algorithm",
            "memory pattern",
            "file system",
            "registry",
            "registry keys",
            "process",
            "created",
            "processes tree",
            "february",
            "healthone",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "url https",
            "reverse dns",
            "general full",
            "security tls",
            "protocol h2",
            "software",
            "frankfurt",
            "main",
            "germany",
            "resource hash",
            "de indicators",
            "hashes",
            "value",
            "scriptsrcelem",
            "variables",
            "boomrmq string",
            "boomrapikey",
            "boomr function",
            "system",
            "babelpolyfill",
            "assign function",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "aes256gcm",
            "level",
            "akamaiasn1",
            "europeberlin",
            "generic malware",
            "tag count",
            "tue dec",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "root ca",
            "pattern match",
            "authority",
            "span",
            "presbyterianst",
            "luke",
            "medical center",
            "class",
            "accept",
            "date",
            "refresh",
            "blood",
            "liver cancer",
            "breast cancer",
            "lung cancer",
            "kidney cancer",
            "skin cancer",
            "sarcoma",
            "prostate cancer",
            "body",
            "facebook",
            "twitter",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "cookie",
            "command and control",
            "mitre",
            "scanning host",
            "exploit source",
            "trojan",
            "callback function",
            "targets",
            "targeting",
            "samesite=none",
            "kde",
            "konqueror",
            "phi",
            "pii",
            "wTJh.exe",
            "malware ransom trojan evader rat",
            "network",
            "rat trojan",
            "relacionada",
            "critical risk",
            "cyberstalking",
            "elf collection",
            "matches rule",
            "emotet",
            "lockbit",
            "critical",
            "copy",
            "installer",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "ursnif",
            "core",
            "as55688 pt",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "asn as55688",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "united",
            "aaaa",
            "unknown",
            "a domains",
            "search",
            "creation date",
            "record value",
            "next",
            "pornhub",
            "anyxxxtube",
            "domain",
            "gandi sas",
            "hostname",
            "basic",
            "pe32",
            "intel",
            "ms windows",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "pe32 packer",
            "petite",
            "vs98",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "rticon neutral",
            "overlay",
            "dos exe",
            "threat roundup",
            "pe resource",
            "june",
            "lumma stealer",
            "ransomexx",
            "azorult",
            "njrat",
            "open",
            "problem",
            "plugx",
            "android",
            "sex_phot.jpg.exe",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "delphi generic",
            "icons library",
            "pe32 linker",
            "lcc linker",
            "empty hash",
            "tulach",
            "sabey",
            "rat",
            "remote",
            "remote access trojan"
          ],
          "references": [
            "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
            "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
            "www2.megawebfind.com [command and control]",
            "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
            "20.99.186.246 [exploit source]",
            "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
            "Win32:RATX-gen [Trj] identified.",
            "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
            "CS Sigma Rules: Disable UAC Using Registry by frack113",
            "http://45.159.189.105/bot/regex [ tracking | botnet]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
            "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "Remote Access Trojan"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Indonesia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Win32:RATX-gen [Trj]",
              "display_name": "Win32:RATX-gen [Trj]",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "W32/Hupigon.NCU",
              "display_name": "W32/Hupigon.NCU",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Azorult",
              "display_name": "Azorult",
              "target": null
            },
            {
              "id": "Wiper",
              "display_name": "Wiper",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 68,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 883,
            "URL": 1412,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 231,
            "FileHash-SHA256": 2909,
            "domain": 824,
            "email": 3,
            "CVE": 3
          },
          "indicator_count": 6548,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "817 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb9815816db0de034f3a3",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:17.285000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb98c440c1c45ec12ccdc",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:28.063000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb98d9818cca8f130c195",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:29.619000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb998c3b7662e5059b6c2",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:40.759000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "angebot.staude.de",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "Trojan:Win32/WannaCry.350",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "Remote Access Trojan",
        "support.apple.com [nefarious]",
        "www2.megawebfind.com [command and control]",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "http://45.159.189.105/bot/regex [ tracking | botnet]",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "20.99.186.246 [exploit source]",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "cbi.com",
        "caselaw.lawlink.com",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
        "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "ppa.launchpad.net [Apple open use]",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
        "Win32:RATX-gen [Trj] identified.",
        "http://mail.thyrsus.com/ [phishing]",
        "CS Sigma Rules: Disable UAC Using Registry by frack113",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "cellebrite.com | enterprise.cellebrite.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
        "deviceinbox.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Tulach",
            "Azorult",
            "Trojan:win32/wannacry.350",
            "Emotet",
            "Quasar rat",
            "Lockbit",
            "Win32:ratx-gen [trj]",
            "Ransom:win32/makop",
            "Qakbot",
            "W32/hupigon.ncu",
            "Ransomware",
            "Alf:trojan:powershell/dynamicloader",
            "Lumma stealer",
            "Makop",
            "Pws:win32/xport",
            "Formbook",
            "Relic",
            "Ursnif",
            "Pegasus",
            "Wiper",
            "Alf:trojan:win32/formbook",
            "Hacktool",
            "Virut",
            "Cobalt strike",
            "Worm:win32/bloored.e",
            "Dark power",
            "Ransomexx (elf)"
          ],
          "industries": [
            "Healthcare",
            "Civil society"
          ],
          "unique_indicators": 38157
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/vaslam.xyz",
    "whois": "http://whois.domaintools.com/vaslam.xyz",
    "domain": "vaslam.xyz",
    "hostname": "www.vaslam.xyz"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 11,
  "pulses": [
    {
      "id": "69d3532c76eb3bf5edd9609b",
      "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
      "description": "",
      "modified": "2026-04-06T06:31:08.181000",
      "created": "2026-04-06T06:31:08.181000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65bbb998c3b7662e5059b6c2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "58 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d3532a6537880f6e2c68dc",
      "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
      "description": "",
      "modified": "2026-04-06T06:31:06.730000",
      "created": "2026-04-06T06:31:06.730000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65bbb998c3b7662e5059b6c2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "58 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c3bd803f15cd94aab6e287",
      "name": "Lumma Stealer | Colorado Medical Center HCA",
      "description": "Needs further investigation. Miscellaneous attack affecting Denver physicians directory. Visitors accessing the page using insecure devices may be affected. PII & PHI breached. Monitoring.",
      "modified": "2024-03-08T17:04:03.644000",
      "created": "2024-02-07T17:27:28.349000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "execution",
        "resolutions",
        "problems",
        "siblings domain",
        "whois whois",
        "startpage",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "language",
        "html document",
        "unicode text",
        "utf8 text",
        "doctype",
        "anchor hrefs",
        "hrefs",
        "denver",
        "tsara brashears",
        "apple ios",
        "password bypass",
        "apple phone",
        "unlocker",
        "shell code",
        "script",
        "contacted urls",
        "hacktool",
        "malicious",
        "download",
        "malware",
        "relic",
        "monitoring",
        "domains",
        "eurodns sa",
        "markmonitor",
        "ip detections",
        "country",
        "graph",
        "https",
        "mitre att",
        "ta0007 network",
        "t1046 sends",
        "ssdp",
        "command",
        "control ta0011",
        "protocol t1071",
        "performs dns",
        "layer protocol",
        "number",
        "cus cndigicert",
        "ja3s",
        "subject",
        "sha2 secure",
        "server ca",
        "odigicert inc",
        "cus cnmicrosoft",
        "algorithm",
        "memory pattern",
        "file system",
        "registry",
        "registry keys",
        "process",
        "created",
        "processes tree",
        "february",
        "healthone",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "url https",
        "reverse dns",
        "general full",
        "security tls",
        "protocol h2",
        "software",
        "frankfurt",
        "main",
        "germany",
        "resource hash",
        "de indicators",
        "hashes",
        "value",
        "scriptsrcelem",
        "variables",
        "boomrmq string",
        "boomrapikey",
        "boomr function",
        "system",
        "babelpolyfill",
        "assign function",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "aes256gcm",
        "level",
        "akamaiasn1",
        "europeberlin",
        "generic malware",
        "tag count",
        "tue dec",
        "threat report",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "root ca",
        "pattern match",
        "authority",
        "span",
        "presbyterianst",
        "luke",
        "medical center",
        "class",
        "accept",
        "date",
        "refresh",
        "blood",
        "liver cancer",
        "breast cancer",
        "lung cancer",
        "kidney cancer",
        "skin cancer",
        "sarcoma",
        "prostate cancer",
        "body",
        "facebook",
        "twitter",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "cookie",
        "command and control",
        "mitre",
        "scanning host",
        "exploit source",
        "trojan",
        "callback function",
        "targets",
        "targeting",
        "samesite=none",
        "kde",
        "konqueror",
        "phi",
        "pii",
        "wTJh.exe",
        "malware ransom trojan evader rat",
        "network",
        "rat trojan",
        "relacionada",
        "critical risk",
        "cyberstalking",
        "elf collection",
        "matches rule",
        "emotet",
        "lockbit",
        "critical",
        "copy",
        "installer",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "ursnif",
        "core",
        "as55688 pt",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "asn as55688",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "united",
        "aaaa",
        "unknown",
        "a domains",
        "search",
        "creation date",
        "record value",
        "next",
        "pornhub",
        "anyxxxtube",
        "domain",
        "gandi sas",
        "hostname",
        "basic",
        "pe32",
        "intel",
        "ms windows",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "pe32 packer",
        "petite",
        "vs98",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "rticon neutral",
        "overlay",
        "dos exe",
        "threat roundup",
        "pe resource",
        "june",
        "lumma stealer",
        "ransomexx",
        "azorult",
        "njrat",
        "open",
        "problem",
        "plugx",
        "android",
        "sex_phot.jpg.exe",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "delphi generic",
        "icons library",
        "pe32 linker",
        "lcc linker",
        "empty hash",
        "tulach",
        "sabey",
        "rat",
        "remote",
        "remote access trojan"
      ],
      "references": [
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
        "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
        "www2.megawebfind.com [command and control]",
        "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
        "20.99.186.246 [exploit source]",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
        "Win32:RATX-gen [Trj] identified.",
        "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
        "CS Sigma Rules: Disable UAC Using Registry by frack113",
        "http://45.159.189.105/bot/regex [ tracking | botnet]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
        "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "Remote Access Trojan"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Indonesia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Win32:RATX-gen [Trj]",
          "display_name": "Win32:RATX-gen [Trj]",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "W32/Hupigon.NCU",
          "display_name": "W32/Hupigon.NCU",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Azorult",
          "display_name": "Azorult",
          "target": null
        },
        {
          "id": "Wiper",
          "display_name": "Wiper",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 68,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 883,
        "URL": 1412,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 231,
        "FileHash-SHA256": 2909,
        "domain": 824,
        "email": 3,
        "CVE": 3
      },
      "indicator_count": 6548,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "817 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb9815816db0de034f3a3",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:17.285000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb98c440c1c45ec12ccdc",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:28.063000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb98d9818cca8f130c195",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:29.619000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.vaslam.xyz",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.vaslam.xyz",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780511244.2516332
}