{
  "type": "URL",
  "indicator": "https://youhack.ru/threads/629512/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://youhack.ru/threads/629512/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3829106186,
      "indicator": "https://youhack.ru/threads/629512/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "695ea667a062ed6688b104ab",
          "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
          "description": "",
          "modified": "2026-01-07T18:31:03.104000",
          "created": "2026-01-07T18:31:03.104000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "692897a64c0e255409b5a67e",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "101 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695ea6590a50f71a156c9a7f",
          "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
          "description": "",
          "modified": "2026-01-07T18:30:49.442000",
          "created": "2026-01-07T18:30:49.442000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "692897a64c0e255409b5a67e",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "101 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692897a64c0e255409b5a67e",
          "name": "Frost Security | Attorneys | Government | Crazy",
          "description": "Dangerous. Being abused by the usual quasi government suspects. Affecting many targets including Candace Owens. Who can you turn to when your own government is 100% corrupt. \n\nCall me crazy. Idk. DJT was likely shot with a High Velocity Paint Ball. Why isn\u2019t anyone interviewing the families of the 3 \u2018allegedly\u2019 successfully assassinated. \n\nIs Charlie Kirk Dead or in hiding, an alien that doesn\u2019t bleed? \n\nLook it up. High Velocity Paint Ball is a very intensely underrated, nharsky spoken about sport enjoyed by gun enthusiast , snipers , military, civilians. Something weird is going on and it\u2019s actually obvious because they just want results.\n There\u2019s more disturbing things to come. I think more people are being taken out this way than we know.\nBy now I\u2019m under too much surveillance to just leave out casually. \nTerrifying for sure. I know Hos of the Bible is bigger.",
          "modified": "2025-12-27T17:01:06.155000",
          "created": "2025-11-27T18:25:42.570000",
          "tags": [
            "active",
            "type win32",
            "exe size",
            "first seen",
            "malicious avg",
            "win32",
            "gdata",
            "dynamicloader",
            "fe ff",
            "high",
            "write c",
            "data",
            "x00bx00",
            "uswv",
            "write",
            "redline",
            "stream",
            "guard",
            "malware",
            "push",
            "local",
            "crazyfrost",
            "adversarial",
            "hacker",
            "extraction",
            "enter sc",
            "data upload",
            "extre data",
            "included iocs",
            "url http",
            "url https",
            "include review",
            "exclude sugges",
            "frost security",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "united",
            "flag",
            "contacted",
            "http traffic",
            "file defense",
            "mitre att",
            "ck techniques",
            "evasion att",
            "belize",
            "div div",
            "passive dns",
            "link",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "meta",
            "ddos",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "hostname",
            "types",
            "hosanna",
            "x show",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1036",
            "capture",
            "cookie",
            "palantir",
            "indicator role",
            "active related",
            "description",
            "trump supporter",
            "types of",
            "germany",
            "china",
            "netherlands",
            "https",
            "notice",
            "billions",
            "stop",
            "boobs130432 no",
            "expiration",
            "location poland",
            "asn as29522",
            "learn more",
            "domain",
            "foundry",
            "hallrender",
            "brian sabey",
            "tam legal",
            "christopher p ahmann",
            "palantir",
            "quasi government",
            "pentagon"
          ],
          "references": [
            "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
            "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
            "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "http://advocate-smyslova.ru/tsara-brashears/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
            "http://orangeporntube.net/tsara-brashears.html",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://videolal.com/tsara-brashears-dead.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
            "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "http://www.tryporn.net/seach/tsara-brashears/",
            "https://alohatube.xyz/search/tsara-brashearsL",
            "http://onlyindianporn2.com/videos/tsara-brashears/",
            "http://orangeporntube.net/tsara-brashears.html",
            "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
            "https://youjizz.sex/tsara-brashears.html",
            "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
            "https://www.xvxx.me/search/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.sweetheartvideo.com/tsara-brashear",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
            "http://www.bukaporn.net/trend/tsara-brashears/",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://mom2fuck.mobi/tsara-brashears.html",
            "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
            "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
            "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
            "Targeting Tsara Brasheras and associated",
            "Targeting Candace Owens"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3709,
            "hostname": 1109,
            "FileHash-SHA256": 2872,
            "FileHash-MD5": 214,
            "FileHash-SHA1": 203,
            "domain": 557
          },
          "indicator_count": 8664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "112 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "664b74b2683dec84891aef96",
          "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads",
          "description": "http://185.172.128.69/batushka/inte.exe  \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe",
          "modified": "2024-10-14T20:36:05.361000",
          "created": "2024-05-20T16:05:06.313000",
          "tags": [
            "stdin via",
            "nextron",
            "powershell id",
            "powershell",
            "tim rauch",
            "elastic",
            "script block",
            "logging",
            "pe32",
            "ms windows",
            "intel",
            "nazwa typ",
            "md5 nazwa",
            "procesu"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7268,
            "domain": 1310,
            "URL": 8101,
            "FileHash-SHA1": 1615,
            "hostname": 2590,
            "FileHash-MD5": 1852,
            "email": 267,
            "SSLCertFingerprint": 3,
            "CIDR": 38,
            "CVE": 7,
            "IPv4": 15,
            "YARA": 4
          },
          "indicator_count": 23070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 135,
          "modified_text": "551 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b2909ffdc623904cbfd91d",
          "name": "PEXE - DOS executable (COM)",
          "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-25T16:47:26.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757a662a146889c60b6c",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:10.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757d6dd7dae344aed3f5",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:13.209000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85dca7d8bf0aea33abc3a",
          "name": "PEXE - DOS executable ",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-30T02:24:10.454000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b4757a662a146889c60b6c",
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "Found in: https://jbplegal.com",
        "https://youjizz.sex/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-dead.html",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "PEXE - DOS executable (COM)",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "http://sexkompas.xyz",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "Targeting Candace Owens",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "tracking2youdu.com , cdn.livechatinc.com",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ms defender\talf:heraklezeval:trojan:win32/clipbanker",
            "Trojan:win32/glupteba.mt!mtb",
            "Etpro",
            "Win.trojan.buzus-5453",
            "Other malware",
            "Win32:injector-cvf\\ [trj]\t\twin.mal",
            "Win.malware.vtflooder-6260355-1",
            "Win32:malware-gen",
            "Win32:pwsx-gen"
          ],
          "industries": [
            "Legal",
            "Defense",
            "Healthcare",
            "Government",
            "Civil society"
          ],
          "unique_indicators": 50827
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/youhack.ru",
    "whois": "http://whois.domaintools.com/youhack.ru",
    "domain": "youhack.ru",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "695ea667a062ed6688b104ab",
      "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
      "description": "",
      "modified": "2026-01-07T18:31:03.104000",
      "created": "2026-01-07T18:31:03.104000",
      "tags": [
        "active",
        "type win32",
        "exe size",
        "first seen",
        "malicious avg",
        "win32",
        "gdata",
        "dynamicloader",
        "fe ff",
        "high",
        "write c",
        "data",
        "x00bx00",
        "uswv",
        "write",
        "redline",
        "stream",
        "guard",
        "malware",
        "push",
        "local",
        "crazyfrost",
        "adversarial",
        "hacker",
        "extraction",
        "enter sc",
        "data upload",
        "extre data",
        "included iocs",
        "url http",
        "url https",
        "include review",
        "exclude sugges",
        "frost security",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "united",
        "flag",
        "contacted",
        "http traffic",
        "file defense",
        "mitre att",
        "ck techniques",
        "evasion att",
        "belize",
        "div div",
        "passive dns",
        "link",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "meta",
        "ddos",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "hostname",
        "types",
        "hosanna",
        "x show",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1036",
        "capture",
        "cookie",
        "palantir",
        "indicator role",
        "active related",
        "description",
        "trump supporter",
        "types of",
        "germany",
        "china",
        "netherlands",
        "https",
        "notice",
        "billions",
        "stop",
        "boobs130432 no",
        "expiration",
        "location poland",
        "asn as29522",
        "learn more",
        "domain",
        "foundry",
        "hallrender",
        "brian sabey",
        "tam legal",
        "christopher p ahmann",
        "palantir",
        "quasi government",
        "pentagon"
      ],
      "references": [
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://videolal.com/tsara-brashears-dead.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://youjizz.sex/tsara-brashears.html",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "Targeting Candace Owens"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "692897a64c0e255409b5a67e",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3709,
        "hostname": 1109,
        "FileHash-SHA256": 2872,
        "FileHash-MD5": 214,
        "FileHash-SHA1": 203,
        "domain": 557
      },
      "indicator_count": 8664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "101 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695ea6590a50f71a156c9a7f",
      "name": "Frost Security | Attorneys | Government | Crazy | Stop Tampering ",
      "description": "",
      "modified": "2026-01-07T18:30:49.442000",
      "created": "2026-01-07T18:30:49.442000",
      "tags": [
        "active",
        "type win32",
        "exe size",
        "first seen",
        "malicious avg",
        "win32",
        "gdata",
        "dynamicloader",
        "fe ff",
        "high",
        "write c",
        "data",
        "x00bx00",
        "uswv",
        "write",
        "redline",
        "stream",
        "guard",
        "malware",
        "push",
        "local",
        "crazyfrost",
        "adversarial",
        "hacker",
        "extraction",
        "enter sc",
        "data upload",
        "extre data",
        "included iocs",
        "url http",
        "url https",
        "include review",
        "exclude sugges",
        "frost security",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "united",
        "flag",
        "contacted",
        "http traffic",
        "file defense",
        "mitre att",
        "ck techniques",
        "evasion att",
        "belize",
        "div div",
        "passive dns",
        "link",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "meta",
        "ddos",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "hostname",
        "types",
        "hosanna",
        "x show",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1036",
        "capture",
        "cookie",
        "palantir",
        "indicator role",
        "active related",
        "description",
        "trump supporter",
        "types of",
        "germany",
        "china",
        "netherlands",
        "https",
        "notice",
        "billions",
        "stop",
        "boobs130432 no",
        "expiration",
        "location poland",
        "asn as29522",
        "learn more",
        "domain",
        "foundry",
        "hallrender",
        "brian sabey",
        "tam legal",
        "christopher p ahmann",
        "palantir",
        "quasi government",
        "pentagon"
      ],
      "references": [
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://videolal.com/tsara-brashears-dead.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://youjizz.sex/tsara-brashears.html",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "Targeting Candace Owens"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "692897a64c0e255409b5a67e",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3709,
        "hostname": 1109,
        "FileHash-SHA256": 2872,
        "FileHash-MD5": 214,
        "FileHash-SHA1": 203,
        "domain": 557
      },
      "indicator_count": 8664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "101 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692897a64c0e255409b5a67e",
      "name": "Frost Security | Attorneys | Government | Crazy",
      "description": "Dangerous. Being abused by the usual quasi government suspects. Affecting many targets including Candace Owens. Who can you turn to when your own government is 100% corrupt. \n\nCall me crazy. Idk. DJT was likely shot with a High Velocity Paint Ball. Why isn\u2019t anyone interviewing the families of the 3 \u2018allegedly\u2019 successfully assassinated. \n\nIs Charlie Kirk Dead or in hiding, an alien that doesn\u2019t bleed? \n\nLook it up. High Velocity Paint Ball is a very intensely underrated, nharsky spoken about sport enjoyed by gun enthusiast , snipers , military, civilians. Something weird is going on and it\u2019s actually obvious because they just want results.\n There\u2019s more disturbing things to come. I think more people are being taken out this way than we know.\nBy now I\u2019m under too much surveillance to just leave out casually. \nTerrifying for sure. I know Hos of the Bible is bigger.",
      "modified": "2025-12-27T17:01:06.155000",
      "created": "2025-11-27T18:25:42.570000",
      "tags": [
        "active",
        "type win32",
        "exe size",
        "first seen",
        "malicious avg",
        "win32",
        "gdata",
        "dynamicloader",
        "fe ff",
        "high",
        "write c",
        "data",
        "x00bx00",
        "uswv",
        "write",
        "redline",
        "stream",
        "guard",
        "malware",
        "push",
        "local",
        "crazyfrost",
        "adversarial",
        "hacker",
        "extraction",
        "enter sc",
        "data upload",
        "extre data",
        "included iocs",
        "url http",
        "url https",
        "include review",
        "exclude sugges",
        "frost security",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "united",
        "flag",
        "contacted",
        "http traffic",
        "file defense",
        "mitre att",
        "ck techniques",
        "evasion att",
        "belize",
        "div div",
        "passive dns",
        "link",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "meta",
        "ddos",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "hostname",
        "types",
        "hosanna",
        "x show",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1036",
        "capture",
        "cookie",
        "palantir",
        "indicator role",
        "active related",
        "description",
        "trump supporter",
        "types of",
        "germany",
        "china",
        "netherlands",
        "https",
        "notice",
        "billions",
        "stop",
        "boobs130432 no",
        "expiration",
        "location poland",
        "asn as29522",
        "learn more",
        "domain",
        "foundry",
        "hallrender",
        "brian sabey",
        "tam legal",
        "christopher p ahmann",
        "palantir",
        "quasi government",
        "pentagon"
      ],
      "references": [
        "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg\t URL",
        "http://frostsecurity.net/frost/driver/ \u2022 http://frostsecurity.net/frost/frostupdater/",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://vtwctr.org/explore/tsara-brashears-defeats-jeffrey-reimer/ phishing",
        "http://alohatube.xyz/search/tsara-brashears No Expiration\t278\t  URL http://alohatube.xyz/search/tsara-brashears/ No Expiration\t62\t  URL http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears No Expiration\t49\t  URL http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us No Expiration\t27\t  URL http://browntubeporn.com/tsara-brashears.html No Expiration\t40\t  URL http://flexporn.net/tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge phishing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "http://advocate-smyslova.ru/tsara-brashears/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn/;0.48692189815948833",
        "http://orangeporntube.net/tsara-brashears.html",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://videolal.com/tsara-brashears-dead.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language",
        "http://www.bukaporn.net/trend/tsara-brashears/ No Expiration\t41\t  URL http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html No Expiration\t41\t  URL http://www.sweetheartvideo.com/tsara-brashears No Expiration\t81\t  URL http://www.tryporn.net/seach/tsara-brashears/ No Expiration\t41\t  URL http://www.tryporno.net/movies/tsara-brashears/ No Expiration\t42\t  URL https://alohatube.xyz/search/tsara-brashears No Expiration\t211\t  URL https://alohatube.xyz/search/tsara-brashears+ No Expiration\t51\t  URL https://browntubeporn.com/tsara-brashearsAccept-Language No Expiratio",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.tryporn.net/seach/tsara-brashears/",
        "https://alohatube.xyz/search/tsara-brashearsL",
        "http://onlyindianporn2.com/videos/tsara-brashears/",
        "http://orangeporntube.net/tsara-brashears.html",
        "https://www.dirtsearch.org/data/TSARA/BRASHEARS/",
        "https://youjizz.sex/tsara-brashears.html",
        "https://www.feestzalenvanvlaanderen.be/seach/tsara-brashears/",
        "https://www.xvxx.me/search/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.sweetheartvideo.com/tsara-brashear",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://mom2fuck.mobi/tsara-brashears.html",
        "http://vtwctr.org/explore/tsara- brashears-defeats-jeffrey-reimer/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "www.palantir.com \u2022   palantir.io \u2022 http://datafoundry.com/",
        "http://watchhers.net/index.php \u2022  foundry2sdbl.dvr.dn2.n-helix.com",
        "https://steam.exacg.cc/ \u2022  http://tesgm.ru/_ld/5/584_steam_apidll_Th.rar",
        "Targeting Tsara Brasheras and associated",
        "Targeting Candace Owens"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "Ms Defender\tALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3709,
        "hostname": 1109,
        "FileHash-SHA256": 2872,
        "FileHash-MD5": 214,
        "FileHash-SHA1": 203,
        "domain": 557
      },
      "indicator_count": 8664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "112 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "664b74b2683dec84891aef96",
      "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads",
      "description": "http://185.172.128.69/batushka/inte.exe  \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe",
      "modified": "2024-10-14T20:36:05.361000",
      "created": "2024-05-20T16:05:06.313000",
      "tags": [
        "stdin via",
        "nextron",
        "powershell id",
        "powershell",
        "tim rauch",
        "elastic",
        "script block",
        "logging",
        "pe32",
        "ms windows",
        "intel",
        "nazwa typ",
        "md5 nazwa",
        "procesu"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7268,
        "domain": 1310,
        "URL": 8101,
        "FileHash-SHA1": 1615,
        "hostname": 2590,
        "FileHash-MD5": 1852,
        "email": 267,
        "SSLCertFingerprint": 3,
        "CIDR": 38,
        "CVE": 7,
        "IPv4": 15,
        "YARA": 4
      },
      "indicator_count": 23070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 135,
      "modified_text": "551 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b2909ffdc623904cbfd91d",
      "name": "PEXE - DOS executable (COM)",
      "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-25T16:47:26.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757a662a146889c60b6c",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:10.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757d6dd7dae344aed3f5",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:13.209000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85dca7d8bf0aea33abc3a",
      "name": "PEXE - DOS executable ",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-30T02:24:10.454000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b4757a662a146889c60b6c",
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://youhack.ru/threads/629512/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://youhack.ru/threads/629512/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776598120.7545934
}