{ "type": "Domain", "indicator": "barreraselec.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/barreraselec.com", "alexa": "http://www.alexa.com/siteinfo/barreraselec.com", "indicator": "barreraselec.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3680985276, "indicator": "barreraselec.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6474a025e7830f86fcbda9ba", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.\n\nA DLL is a library file containing functions that can be used by more than one program at the same time. When an application is launched, it will attempt to load any required DLLs.\n\nIt does this by searching through specific Windows folders for the DLL and, when found, loads it. However, Windows applications will prioritize DLLs in the same folder as the executable, loading them before all others.", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-29T12:52:53.004000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 307, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 434, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64640f71292ec3dad3e443e0", "name": "URLHaus data - 16-05-2023", "description": "", "modified": "2023-05-16T23:19:13.634000", "created": "2023-05-16T23:19:13.634000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "hajime", "BB28", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "USA", "PowerShellSMTPKeyLogger", "32", "Amadey", "exe", "64", "pw-2023", "rar", "pw-2022", "dropped-by-PrivateLoader", "encrypted", "1234", "7z", "Password-protected", "pw-1515", "dll", "ua-ps" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 133, "domain": 614, "hostname": 1 }, "indicator_count": 1748, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1110 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6462be46411bb325b6da05e9", "name": "URLHaus data - 15-05-2023", "description": "", "modified": "2023-05-15T23:20:38.852000", "created": "2023-05-15T23:20:38.852000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "AsyncRAT", "exe", "mirai", "dropped-by-amadey", "hajime", "geofenced", "obama263", "Qakbot", "USA", "wsf", "zip", "dll", "BB28", "js", "1234", "7z", "Password-protected", "64-bit", "x86-64", "doc", "opendir", "ua-ps", "AgentTesla", "dropped-by-SmokeLoader", "RecordBreaker", "Formbook", "ascii", "NetSupport", "powershell", "ps1", "rat", "ps", "dropped-by-PrivateLoader", "xworm", "SocGholish", "TDS", "2023", "rar", "1375", "glupteba", "viaAmadey", "viaSmokeLoader", "unknown", "32", "RemcosRAT", "encrypted", "1515", "Ngioweb", "discord", "infostealer", "Vidar", "RedLine", "RedLineStealer", "Amadey" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 323, "domain": 544, "hostname": 10 }, "indicator_count": 1877, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549", "https://urlhaus.abuse.ch/browse/", "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6474a025e7830f86fcbda9ba", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.\n\nA DLL is a library file containing functions that can be used by more than one program at the same time. When an application is launched, it will attempt to load any required DLLs.\n\nIt does this by searching through specific Windows folders for the DLL and, when found, loads it. However, Windows applications will prioritize DLLs in the same folder as the executable, loading them before all others.", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-29T12:52:53.004000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 307, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 434, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64640f71292ec3dad3e443e0", "name": "URLHaus data - 16-05-2023", "description": "", "modified": "2023-05-16T23:19:13.634000", "created": "2023-05-16T23:19:13.634000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "hajime", "BB28", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "USA", "PowerShellSMTPKeyLogger", "32", "Amadey", "exe", "64", "pw-2023", "rar", "pw-2022", "dropped-by-PrivateLoader", "encrypted", "1234", "7z", "Password-protected", "pw-1515", "dll", "ua-ps" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 133, "domain": 614, "hostname": 1 }, "indicator_count": 1748, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1110 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6462be46411bb325b6da05e9", "name": "URLHaus data - 15-05-2023", "description": "", "modified": "2023-05-15T23:20:38.852000", "created": "2023-05-15T23:20:38.852000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "AsyncRAT", "exe", "mirai", "dropped-by-amadey", "hajime", "geofenced", "obama263", "Qakbot", "USA", "wsf", "zip", "dll", "BB28", "js", "1234", "7z", "Password-protected", "64-bit", "x86-64", "doc", "opendir", "ua-ps", "AgentTesla", "dropped-by-SmokeLoader", "RecordBreaker", "Formbook", "ascii", "NetSupport", "powershell", "ps1", "rat", "ps", "dropped-by-PrivateLoader", "xworm", "SocGholish", "TDS", "2023", "rar", "1375", "glupteba", "viaAmadey", "viaSmokeLoader", "unknown", "32", "RemcosRAT", "encrypted", "1515", "Ngioweb", "discord", "infostealer", "Vidar", "RedLine", "RedLineStealer", "Amadey" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 323, "domain": 544, "hostname": 10 }, "indicator_count": 1877, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "barreraselec.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "barreraselec.com", "found": true, "verdict": "malicious", "url_count": 3, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://barreraselec.com/uua/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-16", "tags": [ "BB28", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "USA" ] }, { "url": "https://barreraselec.com/erv/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-16", "tags": [ "BB28", "geofenced", "js", "Qakbot", "Quakbot", "USA" ] }, { "url": "https://barreraselec.com/ni/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-15", "tags": [ "BB28", "geofenced", "js", "Qakbot", "Quakbot", "USA" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780227129.4940977 }