{ "type": "Domain", "indicator": "aehack.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/aehack.com", "alexa": "http://www.alexa.com/siteinfo/aehack.com", "indicator": "aehack.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3366328806, "indicator": "aehack.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 20, "pulses": [ { "id": "674a57a3f994d4362861ba41", "name": "InQuest - 29-11-2024", "description": "", "modified": "2024-12-30T00:02:57.497000", "created": "2024-11-30T00:09:07.688000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 129, "URL": 441, "FileHash-SHA256": 641, "hostname": 59, "FileHash-SHA1": 27, "FileHash-MD5": 57 }, "indicator_count": 1354, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "517 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67490654dd6e7b8046e04298", "name": "InQuest - 28-11-2024", "description": "", "modified": "2024-12-29T00:00:17.609000", "created": "2024-11-29T00:09:56.943000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 471, "URL": 352, "domain": 115, "hostname": 46, "FileHash-SHA1": 27, "FileHash-MD5": 56 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "518 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6747b542aea36932ab55c164", "name": "InQuest - 27-11-2024", "description": "", "modified": "2024-12-28T00:01:55.115000", "created": "2024-11-28T00:11:46.187000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 277, "FileHash-SHA256": 338, "FileHash-MD5": 56, "hostname": 32, "domain": 89, "FileHash-SHA1": 27 }, "indicator_count": 819, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "519 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67466349440430bdb1460fa7", "name": "InQuest - 26-11-2024", "description": "", "modified": "2024-12-27T00:01:27.205000", "created": "2024-11-27T00:09:45.453000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 225, "URL": 180, "domain": 63, "FileHash-MD5": 54, "hostname": 17, "FileHash-SHA1": 14 }, "indicator_count": 553, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "520 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674512cf2430ec95191db43c", "name": "InQuest - 25-11-2024", "description": "", "modified": "2024-12-26T00:00:44.753000", "created": "2024-11-26T00:14:07.164000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 218, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 499, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "521 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6743c09f2f0dbeecf12f86a4", "name": "InQuest - 24-11-2024", "description": "", "modified": "2024-12-25T00:01:01.765000", "created": "2024-11-25T00:11:11.156000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "522 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67426fb6973c59a2ddef9ebc", "name": "InQuest - 23-11-2024", "description": "", "modified": "2024-12-24T00:05:22.894000", "created": "2024-11-24T00:13:42.732000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "523 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67411e8ef7d4ae7ff9d40bdf", "name": "InQuest - 22-11-2024", "description": "", "modified": "2024-12-23T00:03:39.548000", "created": "2024-11-23T00:15:09.992000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673fccef26730c97575b15ef", "name": "InQuest - 21-11-2024", "description": "", "modified": "2024-12-22T00:01:22.198000", "created": "2024-11-22T00:14:39.945000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "525 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673e7b3182663860f58debc5", "name": "InQuest - 20-11-2024", "description": "", "modified": "2024-12-21T00:02:42.358000", "created": "2024-11-21T00:13:37.024000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 15, "URL": 136, "FileHash-SHA256": 173, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 451, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "526 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673d29ddd0ffe4039e938d37", "name": "InQuest - 19-11-2024", "description": "", "modified": "2024-12-20T00:04:07.497000", "created": "2024-11-20T00:14:21.370000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 173, "domain": 61, "URL": 135, "FileHash-SHA1": 14, "FileHash-MD5": 52, "hostname": 14 }, "indicator_count": 449, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "527 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673bd90d015a00f2e6e9f779", "name": "InQuest - 18-11-2024", "description": "", "modified": "2024-12-19T00:04:48.031000", "created": "2024-11-19T00:17:17.830000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 169, "domain": 61, "URL": 135, "FileHash-SHA1": 14, "FileHash-MD5": 52, "hostname": 14 }, "indicator_count": 445, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "528 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673a871a475c0e97a32d3d8d", "name": "InQuest - 17-11-2024", "description": "", "modified": "2024-12-18T00:00:36.963000", "created": "2024-11-18T00:15:22.496000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 167, "FileHash-SHA1": 14, "FileHash-MD5": 52, "URL": 134, "domain": 60, "hostname": 14 }, "indicator_count": 441, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "529 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67393574670dea5e6139c8de", "name": "InQuest - 16-11-2024", "description": "", "modified": "2024-12-17T00:00:44.802000", "created": "2024-11-17T00:14:44.136000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 167, "FileHash-SHA1": 14, "FileHash-MD5": 52, "URL": 134, "domain": 60, "hostname": 14 }, "indicator_count": 441, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "530 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6737e461018d56cdf91a9f73", "name": "InQuest - 15-11-2024", "description": "", "modified": "2024-12-16T00:02:16.434000", "created": "2024-11-16T00:16:33.579000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 167, "FileHash-SHA1": 14, "FileHash-MD5": 52, "URL": 134, "domain": 60, "hostname": 14 }, "indicator_count": 441, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "531 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673692739440cea72aad5bb3", "name": "InQuest - 14-11-2024", "description": "", "modified": "2024-12-15T00:01:53.531000", "created": "2024-11-15T00:14:43.192000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 55, "URL": 123, "FileHash-SHA256": 63, "FileHash-MD5": 51, "hostname": 14, "FileHash-SHA1": 13 }, "indicator_count": 319, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "532 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67440f59b6e706cf2ccfbaed", "name": "New PXA Stealer targets government and education sectors for sensitive information", "description": "", "modified": "2024-11-25T05:47:05.124000", "created": "2024-11-25T05:47:05.124000", "tags": [ "top story", "landing page top story", "stealer", "threat spotlight", "pxa stealer", "system", "discord", "facebook", "cisco secure", "python program", "telegram bot", "tvdseo", "path", "compression", "python", "powershell", "lone", "mini", "import", "next", "local", "mercury", "desktop", "umbrella", "coralraider", "threat", "javascript", "pxa" ], "references": [ "https://blog.talosintelligence.com/new-pxa-stealer/", "new-pxa-stealer.txt" ], "public": 1, "adversary": "CoralRaider", "targeted_countries": [ "India", "Sweden", "Denmark", "Taiwan" ], "malware_families": [ { "id": "JavaScript", "display_name": "JavaScript", "target": null }, { "id": "PXA", "display_name": "PXA", "target": null } ], "attack_ids": [ { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" } ], "industries": [ "Financial", "Gaming", "Education", "Government" ], "TLP": "white", "cloned_from": "673ecfdfa5c41dd0b2f7cd66", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "FileHash-SHA256": 7, "FileHash-MD5": 3, "FileHash-SHA1": 3, "URL": 15 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "552 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673ecfdfa5c41dd0b2f7cd66", "name": "New PXA Stealer targets government and education sectors for sensitive information", "description": "", "modified": "2024-11-21T06:14:55.352000", "created": "2024-11-21T06:14:55.352000", "tags": [ "top story", "landing page top story", "stealer", "threat spotlight", "pxa stealer", "system", "discord", "facebook", "cisco secure", "python program", "telegram bot", "tvdseo", "path", "compression", "python", "powershell", "lone", "mini", "import", "next", "local", "mercury", "desktop", "umbrella", "coralraider", "threat", "javascript", "pxa" ], "references": [ "https://blog.talosintelligence.com/new-pxa-stealer/", "new-pxa-stealer.txt" ], "public": 1, "adversary": "CoralRaider", "targeted_countries": [ "India", "Sweden", "Denmark", "Taiwan" ], "malware_families": [ { "id": "JavaScript", "display_name": "JavaScript", "target": null }, { "id": "PXA", "display_name": "PXA", "target": null } ], "attack_ids": [ { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" } ], "industries": [ "Financial", "Gaming", "Education", "Government" ], "TLP": "white", "cloned_from": "673780b29160b9a7a693bf97", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "FileHash-SHA256": 7, "FileHash-MD5": 3, "FileHash-SHA1": 3, "URL": 15 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 187, "modified_text": "556 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673780b29160b9a7a693bf97", "name": "Vietnamese Hacker Group Deploys New PXA Stealer Targeting Europe and Asia", "description": "A Vietnamese-speaking threat actor has been linked to an information-stealing campaign targeting government and education entities in Europe and Asia with a new Python-based malware called PXA Stealer.", "modified": "2024-11-15T17:14:41.914000", "created": "2024-11-15T17:11:14.150000", "tags": [ "top story", "landing page top story", "stealer", "threat spotlight", "pxa stealer", "system", "discord", "facebook", "cisco secure", "python program", "telegram bot", "tvdseo", "path", "compression", "python", "powershell", "lone", "mini", "import", "next", "local", "mercury", "desktop", "umbrella", "coralraider", "threat", "javascript", "pxa" ], "references": [ "https://blog.talosintelligence.com/new-pxa-stealer/", "new-pxa-stealer.txt" ], "public": 1, "adversary": "CoralRaider", "targeted_countries": [ "India", "Sweden", "Denmark", "Taiwan" ], "malware_families": [ { "id": "JavaScript", "display_name": "JavaScript", "target": null }, { "id": "PXA", "display_name": "PXA", "target": null } ], "attack_ids": [ { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" } ], "industries": [ "Financial", "Gaming", "Education", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Jnorton16", "id": "281242", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "FileHash-SHA256": 7, "FileHash-MD5": 3, "FileHash-SHA1": 3, "URL": 15 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "561 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f619b8af17dd81e6f77b00", "name": "NewDom-0-20220130", "description": "ICANN-Dom", "modified": "2022-03-16T00:02:55.894000", "created": "2022-01-30T04:53:12.753000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 202, "modified_text": "1537 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "references": [ "https://blog.talosintelligence.com/new-pxa-stealer/", "https://labs.inquest.net/iocdb", "new-pxa-stealer.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "CoralRaider" ], "malware_families": [ "Pxa", "Javascript" ], "industries": [ "Government", "Education", "Financial", "Gaming" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 20, "pulses": [ { "id": "674a57a3f994d4362861ba41", "name": "InQuest - 29-11-2024", "description": "", "modified": "2024-12-30T00:02:57.497000", "created": "2024-11-30T00:09:07.688000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 129, "URL": 441, "FileHash-SHA256": 641, "hostname": 59, "FileHash-SHA1": 27, "FileHash-MD5": 57 }, "indicator_count": 1354, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "517 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67490654dd6e7b8046e04298", "name": "InQuest - 28-11-2024", "description": "", "modified": "2024-12-29T00:00:17.609000", "created": "2024-11-29T00:09:56.943000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 471, "URL": 352, "domain": 115, "hostname": 46, "FileHash-SHA1": 27, "FileHash-MD5": 56 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "518 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6747b542aea36932ab55c164", "name": "InQuest - 27-11-2024", "description": "", "modified": "2024-12-28T00:01:55.115000", "created": "2024-11-28T00:11:46.187000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 277, "FileHash-SHA256": 338, "FileHash-MD5": 56, "hostname": 32, "domain": 89, "FileHash-SHA1": 27 }, "indicator_count": 819, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "519 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67466349440430bdb1460fa7", "name": "InQuest - 26-11-2024", "description": "", "modified": "2024-12-27T00:01:27.205000", "created": "2024-11-27T00:09:45.453000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 225, "URL": 180, "domain": 63, "FileHash-MD5": 54, "hostname": 17, "FileHash-SHA1": 14 }, "indicator_count": 553, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "520 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674512cf2430ec95191db43c", "name": "InQuest - 25-11-2024", "description": "", "modified": "2024-12-26T00:00:44.753000", "created": "2024-11-26T00:14:07.164000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 218, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 499, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "521 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6743c09f2f0dbeecf12f86a4", "name": "InQuest - 24-11-2024", "description": "", "modified": "2024-12-25T00:01:01.765000", "created": "2024-11-25T00:11:11.156000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "522 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67426fb6973c59a2ddef9ebc", "name": "InQuest - 23-11-2024", "description": "", "modified": "2024-12-24T00:05:22.894000", "created": "2024-11-24T00:13:42.732000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "523 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67411e8ef7d4ae7ff9d40bdf", "name": "InQuest - 22-11-2024", "description": "", "modified": "2024-12-23T00:03:39.548000", "created": "2024-11-23T00:15:09.992000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673fccef26730c97575b15ef", "name": "InQuest - 21-11-2024", "description": "", "modified": "2024-12-22T00:01:22.198000", "created": "2024-11-22T00:14:39.945000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 177, "URL": 139, "hostname": 15, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 458, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "525 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "673e7b3182663860f58debc5", "name": "InQuest - 20-11-2024", "description": "", "modified": "2024-12-21T00:02:42.358000", "created": "2024-11-21T00:13:37.024000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 15, "URL": 136, "FileHash-SHA256": 173, "domain": 61, "FileHash-SHA1": 14, "FileHash-MD5": 52 }, "indicator_count": 451, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "526 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "aehack.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "aehack.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780235923.1254082 }