{
  "type": "Domain",
  "indicator": "sc386.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/sc386.com",
    "alexa": "http://www.alexa.com/siteinfo/sc386.com",
    "indicator": "sc386.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3793540275,
      "indicator": "sc386.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "66b878d22e70b331adf96ada",
          "name": "Cryptowall affecting Social Media and other Enterprise Resources",
          "description": "*Cryptowall\nby Malpedia\nCryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.\n\nCryptowall\nUpdated 8 days ago by Malpedia\ntrusted CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.",
          "modified": "2024-09-10T07:03:46.003000",
          "created": "2024-08-11T08:39:46.489000",
          "tags": [
            "default",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "cryptowall",
            "malware beacon",
            "show",
            "inprocserver32",
            "suspicious",
            "copy",
            "write",
            "unknown",
            "malware",
            "main",
            "look",
            "install",
            "pe features",
            "network icmp",
            "creates exe",
            "packer entropy",
            "injection runpe",
            "dumped buffer",
            "allocates rwx",
            "exe appdata",
            "pe unknown",
            "resource name",
            "dynamicloader",
            "medium",
            "high",
            "passive dns",
            "urls",
            "domain",
            "creation date",
            "ransom",
            "date",
            "next",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "historical ssl",
            "referrer",
            "pe file",
            "downloads",
            "http route",
            "found",
            "logon autostart",
            "execution t1547",
            "registry run",
            "keys",
            "startup folder",
            "system process",
            "window",
            "post http",
            "response",
            "get https",
            "cachecontrol",
            "pragma nocache",
            "accept",
            "cnr3 cus",
            "number",
            "subject",
            "user",
            "runtime modules",
            "samplepath",
            "userprofile",
            "signals mutexes",
            "appdata",
            "local",
            "temp",
            "rarsfx0",
            "iconcacheinit",
            "mutexes",
            "defaulttabtip",
            "windir",
            "process",
            "created",
            "shell commands",
            "k wersvcgroup",
            "registry keys",
            "registry",
            "shell folders",
            "hkeyusers",
            "storage",
            "peexe",
            "programfiles",
            "appdatalocal",
            "localappdata",
            "serial number",
            "signature",
            "file",
            "x509",
            "name",
            "issuer enigma",
            "protector ca",
            "valid from",
            "usage client",
            "auth algorithm",
            "vhash",
            "imphash",
            "rich pe",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "intel",
            "ms windows",
            "trid win32",
            "dynamic link",
            "enigma",
            "vs2008",
            "rticon english",
            "vs2008 sp1",
            "contained",
            "info compiler",
            "products",
            "header target",
            "machine intel",
            "utc entry",
            "point"
          ],
          "references": [
            "Antivirus Detections: Win.Ransomware.Cryakl-7691592-0  Alerts injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
            "IDS Detections: CryptoWall Check-in TLS Handshake Failure",
            "Yara Detections: EnigmaProtector ,  WinRAR_SFX ,  xor_0x1f_This_program",
            "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
            "CS Sigma: Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "CS Sigma Rules: Matches rule Uncommon Svchost Parent Process by Florian Roth (Nextron Systems)",
            "CS Sigma Rules: Matches rule Windows Processes Suspicious Parent Directory by vburov",
            "Privilege Escalation TA0004 Process Injection T1055 Early bird code injection technique detected",
            "\u2205 The sandbox C2AE flags this file as: RANSOM | Matches rule MALWARE-CNC Win.Trojan.FileEncoder variant outbound connection",
            "\u2205 System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes",
            "\u2205 Maps a DLL or memory area into another process  \u2205 Queues an APC in another process (thread)",
            "\u2205  Early bird code injection technique detected  System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes  \u2205 Maps a DLL or memory area into another process",
            "Matches rule ET MALWARE CryptoWall Check-in Matches rule ET INFO HTTP Request to a *.asia domain",
            "\u2205 Queues an APC in another process (thread injection)",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7bfcaf9d12548e7653109601a8678c94a92abce57cbddcc04939c422d9bb348",
            "pc.all-to-all.com",
            "x.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Win.Ransomware.Cryakl",
              "display_name": "Win.Ransomware.Cryakl",
              "target": null
            },
            {
              "id": "Trojan.Cryakl/Crowti",
              "display_name": "Trojan.Cryakl/Crowti",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 79,
            "FileHash-SHA1": 60,
            "FileHash-SHA256": 298,
            "SSLCertFingerprint": 1,
            "URL": 313,
            "domain": 89,
            "hostname": 62
          },
          "indicator_count": 902,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "628 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5c5ebba25ca46fc5b36bc",
          "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:11:39.752000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "msie",
            "chrome",
            "certificate",
            "hostname",
            "url analysis",
            "http response",
            "final url",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers date",
            "connection",
            "date sat",
            "html info",
            "forbidden",
            "google tag",
            "utc aw741566034",
            "utc redirection",
            "asnone united",
            "as54113",
            "cname",
            "script urls",
            "as19527 google",
            "as35280 acorus",
            "encrypt",
            "reverse dns",
            "location dublin",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "as4808 china",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "tulach",
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "social engineering",
            "contact made by mark brian sabey",
            "contact made by o'dea",
            "benjamin c"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4655,
            "URL": 9981,
            "FileHash-MD5": 219,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 6722,
            "hostname": 4341,
            "CVE": 2,
            "email": 12,
            "BitcoinAddress": 3
          },
          "indicator_count": 26148,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbadc21b9891c459b9d2",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:13.975000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9995,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbbbcb7a479db222f053",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:27.745000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9996,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 26000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80944a3d1c9e36346e0c1",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "",
          "modified": "2024-02-27T03:01:21.421000",
          "created": "2024-01-29T20:23:32.737000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "65b5cbbbcb7a479db222f053",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4174,
            "URL": 9617,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6801,
            "hostname": 4314,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25400,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "656df672e2e10d7cbf8435ed",
          "name": "Sharktech CNC IPv4 |  Hostile Host IOC's",
          "description": "Datacenter /Hosting /VPS",
          "modified": "2024-01-03T14:02:32.483000",
          "created": "2023-12-04T15:55:30.953000",
          "tags": [
            "date hash",
            "avast avg",
            "win32",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "hostnames",
            "detection list",
            "blacklist",
            "phishing",
            "south carolina",
            "federal credit",
            "union",
            "team",
            "bank",
            "spammer",
            "attacker",
            "traffic",
            "tor known",
            "node tcp",
            "exit",
            "tor relayrouter",
            "hostile host",
            "threats et",
            "host",
            "samples",
            "win32 exe",
            "adv tool",
            "files",
            "type name",
            "dns replication",
            "date",
            "domain",
            "70.39.84.237 cnc",
            "sharktech",
            "autonomous system label",
            "creation date",
            "search",
            "dnssec",
            "showing",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse submit",
            "url analysis",
            "passive dns",
            "next",
            "urls",
            "summary",
            "sample",
            "count blacklist",
            "tag count",
            "tag combined",
            "contacted",
            "whois record",
            "execution",
            "ssl certificate",
            "dropped",
            "whois whois",
            "communicating",
            "referrer",
            "ip summary",
            "url summary",
            "red canary"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/a601cef349fc24d22747934e190b38dd3dbdb7295f0556e80236cf8f74aa4a3b"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Trojan.Scar",
              "display_name": "Trojan.Scar",
              "target": null
            },
            {
              "id": "Win32: Evo-Gen",
              "display_name": "Win32: Evo-Gen",
              "target": null
            },
            {
              "id": "VBS/StartPage.B",
              "display_name": "VBS/StartPage.B",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 507,
            "FileHash-SHA1": 259,
            "FileHash-SHA256": 606,
            "URL": 1723,
            "domain": 353,
            "hostname": 553,
            "email": 2
          },
          "indicator_count": 4003,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "879 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "656df67751c2e5048558c431",
          "name": "Sharktech CNC IPv4 |  Hostile Host IOC's",
          "description": "Datacenter /Hosting /VPS",
          "modified": "2024-01-03T14:02:32.483000",
          "created": "2023-12-04T15:55:35.485000",
          "tags": [
            "date hash",
            "avast avg",
            "win32",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "hostnames",
            "detection list",
            "blacklist",
            "phishing",
            "south carolina",
            "federal credit",
            "union",
            "team",
            "bank",
            "spammer",
            "attacker",
            "traffic",
            "tor known",
            "node tcp",
            "exit",
            "tor relayrouter",
            "hostile host",
            "threats et",
            "host",
            "samples",
            "win32 exe",
            "adv tool",
            "files",
            "type name",
            "dns replication",
            "date",
            "domain",
            "70.39.84.237 cnc",
            "sharktech",
            "autonomous system label",
            "creation date",
            "search",
            "dnssec",
            "showing",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse submit",
            "url analysis",
            "passive dns",
            "next",
            "urls",
            "summary",
            "sample",
            "count blacklist",
            "tag count",
            "tag combined",
            "contacted",
            "whois record",
            "execution",
            "ssl certificate",
            "dropped",
            "whois whois",
            "communicating",
            "referrer",
            "ip summary",
            "url summary",
            "red canary"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/a601cef349fc24d22747934e190b38dd3dbdb7295f0556e80236cf8f74aa4a3b"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Trojan.Scar",
              "display_name": "Trojan.Scar",
              "target": null
            },
            {
              "id": "Win32: Evo-Gen",
              "display_name": "Win32: Evo-Gen",
              "target": null
            },
            {
              "id": "VBS/StartPage.B",
              "display_name": "VBS/StartPage.B",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 507,
            "FileHash-SHA1": 259,
            "FileHash-SHA256": 606,
            "URL": 1723,
            "domain": 353,
            "hostname": 553,
            "email": 2
          },
          "indicator_count": 4003,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "879 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net",
        "\u2205 The sandbox C2AE flags this file as: RANSOM | Matches rule MALWARE-CNC Win.Trojan.FileEncoder variant outbound connection",
        "Matches rule ET MALWARE CryptoWall Check-in Matches rule ET INFO HTTP Request to a *.asia domain",
        "x.com",
        "training001.blackbagtech.com [opportunity?]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
        "https://www.hybrid-analysis.com/sample/a601cef349fc24d22747934e190b38dd3dbdb7295f0556e80236cf8f74aa4a3b",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "IDS Detections: CryptoWall Check-in TLS Handshake Failure",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Antivirus Detections: Win.Ransomware.Cryakl-7691592-0  Alerts injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
        "CS Sigma Rules: Matches rule Windows Processes Suspicious Parent Directory by vburov",
        "Privilege Escalation TA0004 Process Injection T1055 Early bird code injection technique detected",
        "deviceinbox.com [malware hosting]",
        "\u2205 Queues an APC in another process (thread injection)",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "enterprise.cellebrite.com [ digitalclues.com]",
        "Yara Detections: EnigmaProtector ,  WinRAR_SFX ,  xor_0x1f_This_program",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "\u2205 System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes",
        "CS Sigma: Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "\u2205  Early bird code injection technique detected  System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes  \u2205 Maps a DLL or memory area into another process",
        "CS Sigma Rules: Matches rule Uncommon Svchost Parent Process by Florian Roth (Nextron Systems)",
        "https://tulach.cc/ [malware engineering | phishing]",
        "https://www.nsogroup.com",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "\u2205 Maps a DLL or memory area into another process  \u2205 Queues an APC in another process (thread)",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "pc.all-to-all.com",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7bfcaf9d12548e7653109601a8678c94a92abce57cbddcc04939c422d9bb348",
        "message.htm.com [ message stealer]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO Group"
          ],
          "malware_families": [
            "Vbs/startpage.b",
            "Win.ransomware.cryakl",
            "Eternalblue",
            "Amadey",
            "Trojan.cryakl/crowti",
            "Alf:heraklezeval:trojan:msil/trojandropper",
            "Backdoor:win32/mydoom",
            "Et",
            "Quasar rat",
            "Pegasus",
            "Trojan.scar",
            "Win32: evo-gen",
            "Ransom:win32/crowti.a",
            "Tulach"
          ],
          "industries": [
            "Healthcare",
            "Civil society",
            "Technology"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "66b878d22e70b331adf96ada",
      "name": "Cryptowall affecting Social Media and other Enterprise Resources",
      "description": "*Cryptowall\nby Malpedia\nCryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.\n\nCryptowall\nUpdated 8 days ago by Malpedia\ntrusted CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.",
      "modified": "2024-09-10T07:03:46.003000",
      "created": "2024-08-11T08:39:46.489000",
      "tags": [
        "default",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "cryptowall",
        "malware beacon",
        "show",
        "inprocserver32",
        "suspicious",
        "copy",
        "write",
        "unknown",
        "malware",
        "main",
        "look",
        "install",
        "pe features",
        "network icmp",
        "creates exe",
        "packer entropy",
        "injection runpe",
        "dumped buffer",
        "allocates rwx",
        "exe appdata",
        "pe unknown",
        "resource name",
        "dynamicloader",
        "medium",
        "high",
        "passive dns",
        "urls",
        "domain",
        "creation date",
        "ransom",
        "date",
        "next",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "historical ssl",
        "referrer",
        "pe file",
        "downloads",
        "http route",
        "found",
        "logon autostart",
        "execution t1547",
        "registry run",
        "keys",
        "startup folder",
        "system process",
        "window",
        "post http",
        "response",
        "get https",
        "cachecontrol",
        "pragma nocache",
        "accept",
        "cnr3 cus",
        "number",
        "subject",
        "user",
        "runtime modules",
        "samplepath",
        "userprofile",
        "signals mutexes",
        "appdata",
        "local",
        "temp",
        "rarsfx0",
        "iconcacheinit",
        "mutexes",
        "defaulttabtip",
        "windir",
        "process",
        "created",
        "shell commands",
        "k wersvcgroup",
        "registry keys",
        "registry",
        "shell folders",
        "hkeyusers",
        "storage",
        "peexe",
        "programfiles",
        "appdatalocal",
        "localappdata",
        "serial number",
        "signature",
        "file",
        "x509",
        "name",
        "issuer enigma",
        "protector ca",
        "valid from",
        "usage client",
        "auth algorithm",
        "vhash",
        "imphash",
        "rich pe",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "intel",
        "ms windows",
        "trid win32",
        "dynamic link",
        "enigma",
        "vs2008",
        "rticon english",
        "vs2008 sp1",
        "contained",
        "info compiler",
        "products",
        "header target",
        "machine intel",
        "utc entry",
        "point"
      ],
      "references": [
        "Antivirus Detections: Win.Ransomware.Cryakl-7691592-0  Alerts injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
        "IDS Detections: CryptoWall Check-in TLS Handshake Failure",
        "Yara Detections: EnigmaProtector ,  WinRAR_SFX ,  xor_0x1f_This_program",
        "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat injection_process_hollowing",
        "CS Sigma: Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "CS Sigma Rules: Matches rule Uncommon Svchost Parent Process by Florian Roth (Nextron Systems)",
        "CS Sigma Rules: Matches rule Windows Processes Suspicious Parent Directory by vburov",
        "Privilege Escalation TA0004 Process Injection T1055 Early bird code injection technique detected",
        "\u2205 The sandbox C2AE flags this file as: RANSOM | Matches rule MALWARE-CNC Win.Trojan.FileEncoder variant outbound connection",
        "\u2205 System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes",
        "\u2205 Maps a DLL or memory area into another process  \u2205 Queues an APC in another process (thread)",
        "\u2205  Early bird code injection technique detected  System process connects to network (likely due to code injection) \u2205 Injects a PE file into a foreign processes  \u2205 Maps a DLL or memory area into another process",
        "Matches rule ET MALWARE CryptoWall Check-in Matches rule ET INFO HTTP Request to a *.asia domain",
        "\u2205 Queues an APC in another process (thread injection)",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7bfcaf9d12548e7653109601a8678c94a92abce57cbddcc04939c422d9bb348",
        "pc.all-to-all.com",
        "x.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Win.Ransomware.Cryakl",
          "display_name": "Win.Ransomware.Cryakl",
          "target": null
        },
        {
          "id": "Trojan.Cryakl/Crowti",
          "display_name": "Trojan.Cryakl/Crowti",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 79,
        "FileHash-SHA1": 60,
        "FileHash-SHA256": 298,
        "SSLCertFingerprint": 1,
        "URL": 313,
        "domain": 89,
        "hostname": 62
      },
      "indicator_count": 902,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "628 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5c5ebba25ca46fc5b36bc",
      "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:11:39.752000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "msie",
        "chrome",
        "certificate",
        "hostname",
        "url analysis",
        "http response",
        "final url",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers date",
        "connection",
        "date sat",
        "html info",
        "forbidden",
        "google tag",
        "utc aw741566034",
        "utc redirection",
        "asnone united",
        "as54113",
        "cname",
        "script urls",
        "as19527 google",
        "as35280 acorus",
        "encrypt",
        "reverse dns",
        "location dublin",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "as4808 china",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "tulach",
        "c-67-181-73-197.hsd1.ca.comcast.net",
        "social engineering",
        "contact made by mark brian sabey",
        "contact made by o'dea",
        "benjamin c"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4655,
        "URL": 9981,
        "FileHash-MD5": 219,
        "FileHash-SHA1": 213,
        "FileHash-SHA256": 6722,
        "hostname": 4341,
        "CVE": 2,
        "email": 12,
        "BitcoinAddress": 3
      },
      "indicator_count": 26148,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbadc21b9891c459b9d2",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:13.975000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9995,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbbbcb7a479db222f053",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:27.745000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9996,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 26000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80944a3d1c9e36346e0c1",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "",
      "modified": "2024-02-27T03:01:21.421000",
      "created": "2024-01-29T20:23:32.737000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "65b5cbbbcb7a479db222f053",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4174,
        "URL": 9617,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6801,
        "hostname": 4314,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25400,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "824 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "656df672e2e10d7cbf8435ed",
      "name": "Sharktech CNC IPv4 |  Hostile Host IOC's",
      "description": "Datacenter /Hosting /VPS",
      "modified": "2024-01-03T14:02:32.483000",
      "created": "2023-12-04T15:55:30.953000",
      "tags": [
        "date hash",
        "avast avg",
        "win32",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "blacklist http",
        "cisco umbrella",
        "site",
        "safe site",
        "hostnames",
        "detection list",
        "blacklist",
        "phishing",
        "south carolina",
        "federal credit",
        "union",
        "team",
        "bank",
        "spammer",
        "attacker",
        "traffic",
        "tor known",
        "node tcp",
        "exit",
        "tor relayrouter",
        "hostile host",
        "threats et",
        "host",
        "samples",
        "win32 exe",
        "adv tool",
        "files",
        "type name",
        "dns replication",
        "date",
        "domain",
        "70.39.84.237 cnc",
        "sharktech",
        "autonomous system label",
        "creation date",
        "search",
        "dnssec",
        "showing",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse submit",
        "url analysis",
        "passive dns",
        "next",
        "urls",
        "summary",
        "sample",
        "count blacklist",
        "tag count",
        "tag combined",
        "contacted",
        "whois record",
        "execution",
        "ssl certificate",
        "dropped",
        "whois whois",
        "communicating",
        "referrer",
        "ip summary",
        "url summary",
        "red canary"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/a601cef349fc24d22747934e190b38dd3dbdb7295f0556e80236cf8f74aa4a3b"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Trojan.Scar",
          "display_name": "Trojan.Scar",
          "target": null
        },
        {
          "id": "Win32: Evo-Gen",
          "display_name": "Win32: Evo-Gen",
          "target": null
        },
        {
          "id": "VBS/StartPage.B",
          "display_name": "VBS/StartPage.B",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 507,
        "FileHash-SHA1": 259,
        "FileHash-SHA256": 606,
        "URL": 1723,
        "domain": 353,
        "hostname": 553,
        "email": 2
      },
      "indicator_count": 4003,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "879 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "656df67751c2e5048558c431",
      "name": "Sharktech CNC IPv4 |  Hostile Host IOC's",
      "description": "Datacenter /Hosting /VPS",
      "modified": "2024-01-03T14:02:32.483000",
      "created": "2023-12-04T15:55:35.485000",
      "tags": [
        "date hash",
        "avast avg",
        "win32",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "blacklist http",
        "cisco umbrella",
        "site",
        "safe site",
        "hostnames",
        "detection list",
        "blacklist",
        "phishing",
        "south carolina",
        "federal credit",
        "union",
        "team",
        "bank",
        "spammer",
        "attacker",
        "traffic",
        "tor known",
        "node tcp",
        "exit",
        "tor relayrouter",
        "hostile host",
        "threats et",
        "host",
        "samples",
        "win32 exe",
        "adv tool",
        "files",
        "type name",
        "dns replication",
        "date",
        "domain",
        "70.39.84.237 cnc",
        "sharktech",
        "autonomous system label",
        "creation date",
        "search",
        "dnssec",
        "showing",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse submit",
        "url analysis",
        "passive dns",
        "next",
        "urls",
        "summary",
        "sample",
        "count blacklist",
        "tag count",
        "tag combined",
        "contacted",
        "whois record",
        "execution",
        "ssl certificate",
        "dropped",
        "whois whois",
        "communicating",
        "referrer",
        "ip summary",
        "url summary",
        "red canary"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/a601cef349fc24d22747934e190b38dd3dbdb7295f0556e80236cf8f74aa4a3b"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Trojan.Scar",
          "display_name": "Trojan.Scar",
          "target": null
        },
        {
          "id": "Win32: Evo-Gen",
          "display_name": "Win32: Evo-Gen",
          "target": null
        },
        {
          "id": "VBS/StartPage.B",
          "display_name": "VBS/StartPage.B",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/TrojanDropper",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 507,
        "FileHash-SHA1": 259,
        "FileHash-SHA256": 606,
        "URL": 1723,
        "domain": 353,
        "hostname": 553,
        "email": 2
      },
      "indicator_count": 4003,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "879 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "sc386.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "sc386.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780242486.6193967
}