{
  "type": "Domain",
  "indicator": "013net.com.br",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/013net.com.br",
    "alexa": "http://www.alexa.com/siteinfo/013net.com.br",
    "indicator": "013net.com.br",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4149513616,
      "indicator": "013net.com.br",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6927362a094590b632f8779c",
          "name": "IncursioHack -WhatsApp Malware Campaign Targeting Brazil (GitHub)",
          "description": "This repository contains Indicators of Compromise (IoCs) related to the WhatsApp malware campaign targeting Brazil. It includes:\n\nMalicious domains\nFile hashes (SHA-256, SHA-1, MD5)\nURLs\nReferences to technical analyses and news articles\nThe goal is to provide threat intelligence for defensive purposes, such as DNS blocking, proxy filtering, and malware detection.\n\nVisit: https://github.com/IncursioHack/WhatsApp-Malware-Campaign-Targeting-Brazil",
          "modified": "2026-02-26T18:55:49.942000",
          "created": "2025-11-26T17:17:28.844000",
          "tags": [
            "banker",
            "whatsapp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Brazil"
          ],
          "malware_families": [
            {
              "id": "Eternity",
              "display_name": "Eternity",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IncursioHack",
            "id": "371344",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 44,
            "hostname": 4
          },
          "indicator_count": 48,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1,
          "modified_text": "93 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69326c41d42decb549286c69",
          "name": "EbeeDec2025 Pt1",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-01-04T05:04:24.496000",
          "created": "2025-12-05T05:23:13.601000",
          "tags": [
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "cve20121823 cve",
            "cve20213156 cve",
            "cve20214034 cve",
            "cve20222588 cve"
          ],
          "references": [],
          "public": 1,
          "adversary": "APT-C-35 (DoNot), Morte Loader, FunkSec Ransomware, Albiriox, eBPF-based rootkits,  Arkanix Stealer",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 145,
            "FileHash-SHA1": 201,
            "FileHash-SHA256": 191,
            "CVE": 9,
            "URL": 35,
            "domain": 72,
            "email": 2,
            "hostname": 26
          },
          "indicator_count": 681,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e6d2973db318d238db21f",
          "name": "Analysis of the WhatsWorm campaign leading to the implementation of the Eternity Stealer",
          "description": "The WhatsWorm campaign represents a significant threat stemming from Brazilian threat actors who have exploited the popular instant messaging application WhatsApp to propagate malware. The campaign initiates with a malicious Visual Basic Script (.vbs) embedded within a ZIP file, disseminated via phishing messages to victims. This script is the starting point of the infection chain, enabling further stages of malware execution.\n\nThe third phase of the campaign involves the execution of a compiled AutolT interpreter, identified as jFqyDSPp.exe, which is designed to carry out a series of functions. It executes a script from an accompanying log file that operates as a Banking Information Stealer and orchestrates the loading of the subsequent fourth stage, known as Eternity Stealer. The AutolT script utilizes Reflective DLL Injection to execute the payload in memory, thereby evading detection systems typically employed in endpoint protection.",
          "modified": "2025-12-02T04:38:01.489000",
          "created": "2025-12-02T04:38:01.489000",
          "tags": [
            "loader",
            "domnios",
            "urls domnios"
          ],
          "references": [
            "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1-1.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Finance"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3,
            "FileHash-SHA256": 8,
            "FileHash-SHA1": 7,
            "FileHash-MD5": 7,
            "CVE": 1
          },
          "indicator_count": 26,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "180 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6924ce41c65779b6f5b87f8f",
          "name": "Heimdall Security Research from ISH Tecnologia analyzes the WhatsWorm campaign leading to the implementation of Eternidade Stealer.",
          "description": "Heimdall Security Research at ISH Tecnologia has identified an advanced malware dissemination campaign via WhatsApp, called WhatsWorm.\n\nThe threat uses Python automation to spread malicious files among contacts and install Eternidade Stealer, a banking trojan focused on stealing credentials and sensitive data.\n\nThe attack combines multiple phases, obfuscation techniques, in-memory execution, use of Process Hollowing, and communication with C&C servers \u2013 a pattern increasingly present in campaigns targeting the Brazilian public.",
          "modified": "2025-11-24T21:29:36.475000",
          "created": "2025-11-24T21:29:36.475000",
          "tags": [
            "WhatsWorm",
            "Eternidade Stealer"
          ],
          "references": [
            "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "display_name": "T1193 - Spearphishing Attachment"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1020",
              "name": "Automated Exfiltration",
              "display_name": "T1020 - Automated Exfiltration"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IcaroCesar",
            "id": "137507",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_137507/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7,
            "domain": 3
          },
          "indicator_count": 10,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 0,
          "modified_text": "187 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6924ce3fd5882927ef1aa9a8",
          "name": "Heimdall Security Research from ISH Tecnologia analyzes the WhatsWorm campaign leading to the implementation of Eternidade Stealer.",
          "description": "Heimdall Security Research at ISH Tecnologia has identified an advanced malware dissemination campaign via WhatsApp, called WhatsWorm.\n\nThe threat uses Python automation to spread malicious files among contacts and install Eternidade Stealer, a banking trojan focused on stealing credentials and sensitive data.\n\nThe attack combines multiple phases, obfuscation techniques, in-memory execution, use of Process Hollowing, and communication with C&C servers \u2013 a pattern increasingly present in campaigns targeting the Brazilian public.",
          "modified": "2025-11-24T21:29:34.014000",
          "created": "2025-11-24T21:29:34.014000",
          "tags": [
            "WhatsWorm",
            "Eternidade Stealer"
          ],
          "references": [
            "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "display_name": "T1193 - Spearphishing Attachment"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1020",
              "name": "Automated Exfiltration",
              "display_name": "T1020 - Automated Exfiltration"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IcaroCesar",
            "id": "137507",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_137507/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7,
            "domain": 3
          },
          "indicator_count": 10,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 0,
          "modified_text": "187 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1-1.pdf",
        "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "APT-C-35 (DoNot), Morte Loader, FunkSec Ransomware, Albiriox, eBPF-based rootkits,  Arkanix Stealer"
          ],
          "malware_families": [
            "Eternity"
          ],
          "industries": [
            "Finance"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6927362a094590b632f8779c",
      "name": "IncursioHack -WhatsApp Malware Campaign Targeting Brazil (GitHub)",
      "description": "This repository contains Indicators of Compromise (IoCs) related to the WhatsApp malware campaign targeting Brazil. It includes:\n\nMalicious domains\nFile hashes (SHA-256, SHA-1, MD5)\nURLs\nReferences to technical analyses and news articles\nThe goal is to provide threat intelligence for defensive purposes, such as DNS blocking, proxy filtering, and malware detection.\n\nVisit: https://github.com/IncursioHack/WhatsApp-Malware-Campaign-Targeting-Brazil",
      "modified": "2026-02-26T18:55:49.942000",
      "created": "2025-11-26T17:17:28.844000",
      "tags": [
        "banker",
        "whatsapp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Brazil"
      ],
      "malware_families": [
        {
          "id": "Eternity",
          "display_name": "Eternity",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IncursioHack",
        "id": "371344",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 44,
        "hostname": 4
      },
      "indicator_count": 48,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1,
      "modified_text": "93 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69326c41d42decb549286c69",
      "name": "EbeeDec2025 Pt1",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-01-04T05:04:24.496000",
      "created": "2025-12-05T05:23:13.601000",
      "tags": [
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "cve20121823 cve",
        "cve20213156 cve",
        "cve20214034 cve",
        "cve20222588 cve"
      ],
      "references": [],
      "public": 1,
      "adversary": "APT-C-35 (DoNot), Morte Loader, FunkSec Ransomware, Albiriox, eBPF-based rootkits,  Arkanix Stealer",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 145,
        "FileHash-SHA1": 201,
        "FileHash-SHA256": 191,
        "CVE": 9,
        "URL": 35,
        "domain": 72,
        "email": 2,
        "hostname": 26
      },
      "indicator_count": 681,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e6d2973db318d238db21f",
      "name": "Analysis of the WhatsWorm campaign leading to the implementation of the Eternity Stealer",
      "description": "The WhatsWorm campaign represents a significant threat stemming from Brazilian threat actors who have exploited the popular instant messaging application WhatsApp to propagate malware. The campaign initiates with a malicious Visual Basic Script (.vbs) embedded within a ZIP file, disseminated via phishing messages to victims. This script is the starting point of the infection chain, enabling further stages of malware execution.\n\nThe third phase of the campaign involves the execution of a compiled AutolT interpreter, identified as jFqyDSPp.exe, which is designed to carry out a series of functions. It executes a script from an accompanying log file that operates as a Banking Information Stealer and orchestrates the loading of the subsequent fourth stage, known as Eternity Stealer. The AutolT script utilizes Reflective DLL Injection to execute the payload in memory, thereby evading detection systems typically employed in endpoint protection.",
      "modified": "2025-12-02T04:38:01.489000",
      "created": "2025-12-02T04:38:01.489000",
      "tags": [
        "loader",
        "domnios",
        "urls domnios"
      ],
      "references": [
        "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1-1.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Finance"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3,
        "FileHash-SHA256": 8,
        "FileHash-SHA1": 7,
        "FileHash-MD5": 7,
        "CVE": 1
      },
      "indicator_count": 26,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "180 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6924ce41c65779b6f5b87f8f",
      "name": "Heimdall Security Research from ISH Tecnologia analyzes the WhatsWorm campaign leading to the implementation of Eternidade Stealer.",
      "description": "Heimdall Security Research at ISH Tecnologia has identified an advanced malware dissemination campaign via WhatsApp, called WhatsWorm.\n\nThe threat uses Python automation to spread malicious files among contacts and install Eternidade Stealer, a banking trojan focused on stealing credentials and sensitive data.\n\nThe attack combines multiple phases, obfuscation techniques, in-memory execution, use of Process Hollowing, and communication with C&C servers \u2013 a pattern increasingly present in campaigns targeting the Brazilian public.",
      "modified": "2025-11-24T21:29:36.475000",
      "created": "2025-11-24T21:29:36.475000",
      "tags": [
        "WhatsWorm",
        "Eternidade Stealer"
      ],
      "references": [
        "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "display_name": "T1193 - Spearphishing Attachment"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1020",
          "name": "Automated Exfiltration",
          "display_name": "T1020 - Automated Exfiltration"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IcaroCesar",
        "id": "137507",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_137507/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7,
        "domain": 3
      },
      "indicator_count": 10,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 0,
      "modified_text": "187 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6924ce3fd5882927ef1aa9a8",
      "name": "Heimdall Security Research from ISH Tecnologia analyzes the WhatsWorm campaign leading to the implementation of Eternidade Stealer.",
      "description": "Heimdall Security Research at ISH Tecnologia has identified an advanced malware dissemination campaign via WhatsApp, called WhatsWorm.\n\nThe threat uses Python automation to spread malicious files among contacts and install Eternidade Stealer, a banking trojan focused on stealing credentials and sensitive data.\n\nThe attack combines multiple phases, obfuscation techniques, in-memory execution, use of Process Hollowing, and communication with C&C servers \u2013 a pattern increasingly present in campaigns targeting the Brazilian public.",
      "modified": "2025-11-24T21:29:34.014000",
      "created": "2025-11-24T21:29:34.014000",
      "tags": [
        "WhatsWorm",
        "Eternidade Stealer"
      ],
      "references": [
        "https://ish.com.br/wp-content/uploads/2025/11/Analise-da-Campanha-do-WhatsWorm-levando-a-implementacao-do-Eternidade-Stealer-1.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "display_name": "T1193 - Spearphishing Attachment"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1020",
          "name": "Automated Exfiltration",
          "display_name": "T1020 - Automated Exfiltration"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IcaroCesar",
        "id": "137507",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_137507/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7,
        "domain": 3
      },
      "indicator_count": 10,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 0,
      "modified_text": "187 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "013net.com.br",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "013net.com.br",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780226225.0602968
}