{ "type": "Domain", "indicator": "aofmfaoc.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/aofmfaoc.com", "alexa": "http://www.alexa.com/siteinfo/aofmfaoc.com", "indicator": "aofmfaoc.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 12853394, "indicator": "aofmfaoc.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "59ce67c830990c6ad9f9c452", "name": "Ramnit \u2013 in-depth analysis", "description": "If we look on Ramnit\u2019s history, it\u2019s hard to exactly pin down which malware family it actually belongs to. One thing is certain, it\u2019s not a new threat. It emerged in 2010, transferred by removable drives within infected executables and HTML files.\n\nA year later, a more dangerous version was released. It contained a part of recently leaked Zeus source code, which allowed Ramnit to become a banking trojan.\n\nThese days, it has become much more sophisticated by utilizing a number of malicious activities including:\n\nPerforming Man-in-the-Browser attacks\nStealing FTP credentials and browser cookies\nUsing DGA (Domain Generation Algorithm) to find the C&C (Command and Control) server\nUsing privilege escalation\nAdding AV exceptions\nUploading screenshots of sensitive information", "modified": "2018-02-08T13:25:20.390000", "created": "2017-09-29T15:33:28.498000", "tags": [ "malware", "Ramnit", "dga", "cert.pl" ], "references": [ "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 72, "upvotes_count": 1.0, "downvotes_count": 0.0, "votes_count": 1.0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "YARA": 1, "domain": 200, "FileHash-SHA256": 21, "CVE": 2, "hostname": 1 }, "indicator_count": 225, "is_author": false, "is_subscribing": null, "subscriber_count": 386819, "modified_text": "3035 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63456c2a30b92337ea1670e0", "name": "IOC Records Provided by @NextRayAI", "description": "This IOC report provided and daily updated by NextRay AI Detection & Response Inc.", "modified": "2026-06-01T00:38:49.108000", "created": "2022-10-11T13:14:18.676000", "tags": [ "Nextray", "cyber security", "ioc", "phishing", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Turkey", "Ukraine", "Romania", "Czechia", "United Kingdom of Great Britain and Northern Ireland", "Norway", "Lithuania", "Estonia", "Latvia", "Poland", "Germany", "Canada", "France", "Denmark" ], "malware_families": [], "attack_ids": [], "industries": [ "Defense", "Industrial", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 1330, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "NextRay-AI", "id": "210822", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_210822/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 498917, "IPv4": 64327, "IPv6": 459, "hostname": 59385, "URL": 166783, "CIDR": 5266, "FileHash-MD5": 29699, "FileHash-SHA256": 50449, "CVE": 348, "email": 914, "Mutex": 49, "FileHash-SHA1": 3453, "FilePath": 34 }, "indicator_count": 880083, "is_author": false, "is_subscribing": null, "subscriber_count": 301, "modified_text": "19 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707a97ec86aca5a06dabe9", "name": "Ramnit \u2013 in-depth analysis", "description": "", "modified": "2023-12-06T13:43:51.434000", "created": "2023-12-06T13:43:51.434000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "YARA": 1, "domain": 200, "FileHash-SHA256": 21, "CVE": 2, "hostname": 1 }, "indicator_count": 225, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64437b58664546346ac025f5", "name": "[2023-04-22] DGA Domains List", "description": "test publication of indicators", "modified": "2023-04-25T06:32:14.321000", "created": "2023-04-22T06:14:48.710000", "tags": [ "zloader", "xshellghost", "wauchos", "volatile", "virut", "vidro", "vawtrak", "tinba", "tempedreve", "suppobox", "sphinx", "sisron", "simda", "shiotob", "shifu", "sharkbot", "rovnix", "ranbyus", "ramnit", "qsnatch", "qadars", "pykspa", "proslikefan", "pizd", "pitou", "padcrypt", "orchard", "omexo", "nymaim2", "nymaim", "ngioweb", "necurs", "necro", "mydoom", "murofet", "monerodownloader", "locky", "kraken", "kingminer", "infy", "hesperbot", "gspy", "gozi", "fosniw", "fobber", "feodo", "enviserv", "dyre", "dromedan", "dircrypt", "corebot", "chinad", "banjori", "bamital" ], "references": [ "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/?from=otx_dga" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "FileHash-MD5": 11, "domain": 803, "hostname": 5 }, "indicator_count": 824, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "1133 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/", "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/?from=otx_dga" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [ "Government", "Industrial", "Defense" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "59ce67c830990c6ad9f9c452", "name": "Ramnit \u2013 in-depth analysis", "description": "If we look on Ramnit\u2019s history, it\u2019s hard to exactly pin down which malware family it actually belongs to. One thing is certain, it\u2019s not a new threat. It emerged in 2010, transferred by removable drives within infected executables and HTML files.\n\nA year later, a more dangerous version was released. It contained a part of recently leaked Zeus source code, which allowed Ramnit to become a banking trojan.\n\nThese days, it has become much more sophisticated by utilizing a number of malicious activities including:\n\nPerforming Man-in-the-Browser attacks\nStealing FTP credentials and browser cookies\nUsing DGA (Domain Generation Algorithm) to find the C&C (Command and Control) server\nUsing privilege escalation\nAdding AV exceptions\nUploading screenshots of sensitive information", "modified": "2018-02-08T13:25:20.390000", "created": "2017-09-29T15:33:28.498000", "tags": [ "malware", "Ramnit", "dga", "cert.pl" ], "references": [ "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 72, "upvotes_count": 1.0, "downvotes_count": 0.0, "votes_count": 1.0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "YARA": 1, "domain": 200, "FileHash-SHA256": 21, "CVE": 2, "hostname": 1 }, "indicator_count": 225, "is_author": false, "is_subscribing": null, "subscriber_count": 386819, "modified_text": "3035 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63456c2a30b92337ea1670e0", "name": "IOC Records Provided by @NextRayAI", "description": "This IOC report provided and daily updated by NextRay AI Detection & Response Inc.", "modified": "2026-06-01T00:38:49.108000", "created": "2022-10-11T13:14:18.676000", "tags": [ "Nextray", "cyber security", "ioc", "phishing", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Turkey", "Ukraine", "Romania", "Czechia", "United Kingdom of Great Britain and Northern Ireland", "Norway", "Lithuania", "Estonia", "Latvia", "Poland", "Germany", "Canada", "France", "Denmark" ], "malware_families": [], "attack_ids": [], "industries": [ "Defense", "Industrial", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 1330, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "NextRay-AI", "id": "210822", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_210822/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 498917, "IPv4": 64327, "IPv6": 459, "hostname": 59385, "URL": 166783, "CIDR": 5266, "FileHash-MD5": 29699, "FileHash-SHA256": 50449, "CVE": 348, "email": 914, "Mutex": 49, "FileHash-SHA1": 3453, "FilePath": 34 }, "indicator_count": 880083, "is_author": false, "is_subscribing": null, "subscriber_count": 301, "modified_text": "19 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707a97ec86aca5a06dabe9", "name": "Ramnit \u2013 in-depth analysis", "description": "", "modified": "2023-12-06T13:43:51.434000", "created": "2023-12-06T13:43:51.434000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "YARA": 1, "domain": 200, "FileHash-SHA256": 21, "CVE": 2, "hostname": 1 }, "indicator_count": 225, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64437b58664546346ac025f5", "name": "[2023-04-22] DGA Domains List", "description": "test publication of indicators", "modified": "2023-04-25T06:32:14.321000", "created": "2023-04-22T06:14:48.710000", "tags": [ "zloader", "xshellghost", "wauchos", "volatile", "virut", "vidro", "vawtrak", "tinba", "tempedreve", "suppobox", "sphinx", "sisron", "simda", "shiotob", "shifu", "sharkbot", "rovnix", "ranbyus", "ramnit", "qsnatch", "qadars", "pykspa", "proslikefan", "pizd", "pitou", "padcrypt", "orchard", "omexo", "nymaim2", "nymaim", "ngioweb", "necurs", "necro", "mydoom", "murofet", "monerodownloader", "locky", "kraken", "kingminer", "infy", "hesperbot", "gspy", "gozi", "fosniw", "fobber", "feodo", "enviserv", "dyre", "dromedan", "dircrypt", "corebot", "chinad", "banjori", "bamital" ], "references": [ "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/?from=otx_dga" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "FileHash-MD5": 11, "domain": 803, "hostname": 5 }, "indicator_count": 824, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "1133 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "aofmfaoc.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "aofmfaoc.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780346257.497988 }