{
  "type": "Domain",
  "indicator": "runlevel6.target",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/runlevel6.target",
    "alexa": "http://www.alexa.com/siteinfo/runlevel6.target",
    "indicator": "runlevel6.target",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3897983198,
      "indicator": "runlevel6.target",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "6659ea571eab262a3942e77c",
          "name": "system.img - Unidentified Android Ext4 filesystem pulled from my machine",
          "description": "Honestly I can't recall where I fished this out of, but I had stashed it on a cloud storage drive for later exploitation, which is what this is. At current, I don't have the slightest clue what it is or what it was doing on my computer. But with majority of the */bin/ files coming back as symlinks to */bin/toybox I'm assuming it's nothing that'd enhance my day to day life for the better. Standby for further analysis. At current these are just the SHA256's of the filesystem itself.",
          "modified": "2024-05-31T15:18:47.112000",
          "created": "2024-05-31T15:18:47.112000",
          "tags": [
            "mntdevfb0",
            "mntdevhda1",
            "mntdevhda3",
            "mntdevkmem",
            "mntdevmem",
            "mntdevmmcblk0p1",
            "mntdevmmcblk0p3",
            "mntdevmtd0",
            "mntdevmtd2",
            "mntdevmtd4"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Merkd1904",
            "id": "196517",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 1991,
            "domain": 70
          },
          "indicator_count": 2063,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 73,
          "modified_text": "729 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "6659ea571eab262a3942e77c",
      "name": "system.img - Unidentified Android Ext4 filesystem pulled from my machine",
      "description": "Honestly I can't recall where I fished this out of, but I had stashed it on a cloud storage drive for later exploitation, which is what this is. At current, I don't have the slightest clue what it is or what it was doing on my computer. But with majority of the */bin/ files coming back as symlinks to */bin/toybox I'm assuming it's nothing that'd enhance my day to day life for the better. Standby for further analysis. At current these are just the SHA256's of the filesystem itself.",
      "modified": "2024-05-31T15:18:47.112000",
      "created": "2024-05-31T15:18:47.112000",
      "tags": [
        "mntdevfb0",
        "mntdevhda1",
        "mntdevhda3",
        "mntdevkmem",
        "mntdevmem",
        "mntdevmmcblk0p1",
        "mntdevmmcblk0p3",
        "mntdevmtd0",
        "mntdevmtd2",
        "mntdevmtd4"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Merkd1904",
        "id": "196517",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 1991,
        "domain": 70
      },
      "indicator_count": 2063,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 73,
      "modified_text": "729 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "runlevel6.target",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "runlevel6.target",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780226298.1784325
}