{
  "type": "Domain",
  "indicator": "args.directory",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/args.directory",
    "alexa": "http://www.alexa.com/siteinfo/args.directory",
    "indicator": "args.directory",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4160769208,
      "indicator": "args.directory",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "693ac21225c36da419dbd4f1",
          "name": "EbeeDec2025 Pt2",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-01-10T13:01:53.320000",
          "created": "2025-12-11T13:07:30.549000",
          "tags": [
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "filename",
            "cve20251338 cve",
            "bitcoinaddress"
          ],
          "references": [
            "Book1.csv"
          ],
          "public": 1,
          "adversary": "ShanyaUDPGangster, CastleRAT, StreamSpy, FvncBot, Multi-Stage Attack Chain using malicious VSCode Ex",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 95,
            "hostname": 42,
            "CIDR": 1,
            "CVE": 2,
            "FileHash-MD5": 193,
            "FileHash-SHA1": 230,
            "FileHash-SHA256": 224,
            "domain": 99,
            "email": 1
          },
          "indicator_count": 887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 38,
          "modified_text": "140 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "693a8d6c8dcd900a702ea750",
          "name": "Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits",
          "description": "Check Point Research conducted a thorough technical analysis of the ValleyRAT malware, also referred to as Winos or Winos4.0. The research primarily focuses on ValleyRAT's sophisticated modular architecture and plugin system, revealing significant insights into its potentially broad deployment following the public release of its builder. This malware notably includes a kernel-mode rootkit within its \u201cDriver Plugin,\u201d which retains valid signatures that allow it to operate on updated Windows 11 systems, thereby circumventing native security features.",
          "modified": "2025-12-11T09:22:52.119000",
          "created": "2025-12-11T09:22:52.119000",
          "tags": [
            "valleyrat",
            "labc",
            "corporationc",
            "windows",
            "hidden rootkit",
            "driver plugin",
            "silver fox",
            "plugin",
            "studio",
            "lief",
            "stealth",
            "rootkit",
            "june",
            "virustotal",
            "extractor",
            "keylogger",
            "telegram",
            "enumerate",
            "trigger",
            "shellcode",
            "into"
          ],
          "references": [
            "https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1055.004",
              "name": "Asynchronous Procedure Call",
              "display_name": "T1055.004 - Asynchronous Procedure Call"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            }
          ],
          "industries": [
            "Entertainment"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 39,
            "FileHash-SHA1": 39,
            "FileHash-SHA256": 39,
            "URL": 3,
            "domain": 2,
            "hostname": 2
          },
          "indicator_count": 124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "170 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/",
        "Book1.csv"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "ShanyaUDPGangster, CastleRAT, StreamSpy, FvncBot, Multi-Stage Attack Chain using malicious VSCode Ex"
          ],
          "malware_families": [],
          "industries": [
            "Entertainment"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "693ac21225c36da419dbd4f1",
      "name": "EbeeDec2025 Pt2",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-01-10T13:01:53.320000",
      "created": "2025-12-11T13:07:30.549000",
      "tags": [
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "filename",
        "cve20251338 cve",
        "bitcoinaddress"
      ],
      "references": [
        "Book1.csv"
      ],
      "public": 1,
      "adversary": "ShanyaUDPGangster, CastleRAT, StreamSpy, FvncBot, Multi-Stage Attack Chain using malicious VSCode Ex",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 95,
        "hostname": 42,
        "CIDR": 1,
        "CVE": 2,
        "FileHash-MD5": 193,
        "FileHash-SHA1": 230,
        "FileHash-SHA256": 224,
        "domain": 99,
        "email": 1
      },
      "indicator_count": 887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 38,
      "modified_text": "140 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "693a8d6c8dcd900a702ea750",
      "name": "Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits",
      "description": "Check Point Research conducted a thorough technical analysis of the ValleyRAT malware, also referred to as Winos or Winos4.0. The research primarily focuses on ValleyRAT's sophisticated modular architecture and plugin system, revealing significant insights into its potentially broad deployment following the public release of its builder. This malware notably includes a kernel-mode rootkit within its \u201cDriver Plugin,\u201d which retains valid signatures that allow it to operate on updated Windows 11 systems, thereby circumventing native security features.",
      "modified": "2025-12-11T09:22:52.119000",
      "created": "2025-12-11T09:22:52.119000",
      "tags": [
        "valleyrat",
        "labc",
        "corporationc",
        "windows",
        "hidden rootkit",
        "driver plugin",
        "silver fox",
        "plugin",
        "studio",
        "lief",
        "stealth",
        "rootkit",
        "june",
        "virustotal",
        "extractor",
        "keylogger",
        "telegram",
        "enumerate",
        "trigger",
        "shellcode",
        "into"
      ],
      "references": [
        "https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1055.004",
          "name": "Asynchronous Procedure Call",
          "display_name": "T1055.004 - Asynchronous Procedure Call"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        }
      ],
      "industries": [
        "Entertainment"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 39,
        "FileHash-SHA1": 39,
        "FileHash-SHA256": 39,
        "URL": 3,
        "domain": 2,
        "hostname": 2
      },
      "indicator_count": 124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "170 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "args.directory",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "args.directory",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780214572.642247
}