{
  "type": "Domain",
  "indicator": "cybertool.shop",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/cybertool.shop",
    "alexa": "http://www.alexa.com/siteinfo/cybertool.shop",
    "indicator": "cybertool.shop",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4166284776,
      "indicator": "cybertool.shop",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "694bde495c4f1023c4a3c1ab",
          "name": "EbeeDec2025 Pt5",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-01-23T12:00:04.403000",
          "created": "2025-12-24T12:36:25.036000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "yara",
            "name"
          ],
          "references": [
            "Book2.csv"
          ],
          "public": 1,
          "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 165,
            "CVE": 5,
            "URL": 86,
            "domain": 146,
            "email": 10,
            "hostname": 40
          },
          "indicator_count": 760,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "127 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6966340114e5dbd3decca476",
          "name": "TI Advisory No-ESAF-SOC-TI-2026-8",
          "description": "A look back at some of the most eye-catching snippets of this year's technology news:-a-year-old, in fact, has been described as \"epidemic\" by some.",
          "modified": "2026-01-13T12:01:05.055000",
          "created": "2026-01-13T12:01:05.055000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "SOC__critical43",
            "id": "361186",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "domain": 526,
            "hostname": 682
          },
          "indicator_count": 1210,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 22,
          "modified_text": "137 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6959adbcca6428aa9db7236e",
          "name": "TI Advisory No-ESAF-SOC-TI-2026-8",
          "description": "",
          "modified": "2026-01-04T00:01:00.758000",
          "created": "2026-01-04T00:01:00.758000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "SOC__critical43",
            "id": "361186",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "domain": 537,
            "hostname": 887
          },
          "indicator_count": 1426,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 22,
          "modified_text": "147 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6948ad21b6173a07485ba382",
          "name": "IOC - Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers",
          "description": "AuraStealer is a rapidly growing infostealer-as-a-service, actively promoted across multiple underground forums since July 2025. The stealer is developed in C++ with a build size of ~500-700 kB and targets Windows systems from Windows 7 to Windows 11. It is marketed as a supposedly highly efficient, low-footprint stealer capable of stealing data from more than 110 browsers, 70 applications (including wallets and 2FA tools), as well as over 250 browser extensions, with the ability to further expand its collection scope through a customizable configuration. Contrary to the advertised claims, AuraStealer still contains multiple flaws that undermine its stealth and evasion capabilities, offering clear detection opportunities for defenders.",
          "modified": "2025-12-22T02:29:53.606000",
          "created": "2025-12-22T02:29:53.606000",
          "tags": [
            "aurastealer"
          ],
          "references": [
            "https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 12,
            "domain": 27
          },
          "indicator_count": 45,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "160 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6947d6de9b1f881707522999",
          "name": "Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers",
          "description": "AuraStealer is a notable malware-as-a-service (MaaS) infostealer that has emerged prominently since July 2025, particularly through Scam-Yourself campaigns. Developed in C++, it targets Windows systems ranging from Windows 7 to Windows 11. The malware is designed to exfiltrate sensitive data from over 110 browsers and 70 applications, including various wallets and two-factor authentication tools, while also having the capability to expand its target range through customizable configurations. Despite its efficient claims, it contains several vulnerabilities that offer detection opportunities for cybersecurity defenses.",
          "modified": "2025-12-21T11:15:42.376000",
          "created": "2025-12-21T11:15:42.376000",
          "tags": [
            "aurastealer",
            "key takeaways",
            "norton",
            "avast",
            "avira",
            "windows run",
            "lumma",
            "vidar"
          ],
          "references": [
            "https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            },
            {
              "id": "Vidar",
              "display_name": "Vidar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 12,
            "domain": 27
          },
          "indicator_count": 45,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "160 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation",
        "Book2.csv"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing"
          ],
          "malware_families": [
            "Lumma",
            "Vidar"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "694bde495c4f1023c4a3c1ab",
      "name": "EbeeDec2025 Pt5",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-01-23T12:00:04.403000",
      "created": "2025-12-24T12:36:25.036000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "yara",
        "name"
      ],
      "references": [
        "Book2.csv"
      ],
      "public": 1,
      "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 149,
        "FileHash-SHA1": 159,
        "FileHash-SHA256": 165,
        "CVE": 5,
        "URL": 86,
        "domain": 146,
        "email": 10,
        "hostname": 40
      },
      "indicator_count": 760,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "127 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6966340114e5dbd3decca476",
      "name": "TI Advisory No-ESAF-SOC-TI-2026-8",
      "description": "A look back at some of the most eye-catching snippets of this year's technology news:-a-year-old, in fact, has been described as \"epidemic\" by some.",
      "modified": "2026-01-13T12:01:05.055000",
      "created": "2026-01-13T12:01:05.055000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "SOC__critical43",
        "id": "361186",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "domain": 526,
        "hostname": 682
      },
      "indicator_count": 1210,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 22,
      "modified_text": "137 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6959adbcca6428aa9db7236e",
      "name": "TI Advisory No-ESAF-SOC-TI-2026-8",
      "description": "",
      "modified": "2026-01-04T00:01:00.758000",
      "created": "2026-01-04T00:01:00.758000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "SOC__critical43",
        "id": "361186",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "domain": 537,
        "hostname": 887
      },
      "indicator_count": 1426,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 22,
      "modified_text": "147 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6948ad21b6173a07485ba382",
      "name": "IOC - Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers",
      "description": "AuraStealer is a rapidly growing infostealer-as-a-service, actively promoted across multiple underground forums since July 2025. The stealer is developed in C++ with a build size of ~500-700 kB and targets Windows systems from Windows 7 to Windows 11. It is marketed as a supposedly highly efficient, low-footprint stealer capable of stealing data from more than 110 browsers, 70 applications (including wallets and 2FA tools), as well as over 250 browser extensions, with the ability to further expand its collection scope through a customizable configuration. Contrary to the advertised claims, AuraStealer still contains multiple flaws that undermine its stealth and evasion capabilities, offering clear detection opportunities for defenders.",
      "modified": "2025-12-22T02:29:53.606000",
      "created": "2025-12-22T02:29:53.606000",
      "tags": [
        "aurastealer"
      ],
      "references": [
        "https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 12,
        "domain": 27
      },
      "indicator_count": 45,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "160 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6947d6de9b1f881707522999",
      "name": "Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers",
      "description": "AuraStealer is a notable malware-as-a-service (MaaS) infostealer that has emerged prominently since July 2025, particularly through Scam-Yourself campaigns. Developed in C++, it targets Windows systems ranging from Windows 7 to Windows 11. The malware is designed to exfiltrate sensitive data from over 110 browsers and 70 applications, including various wallets and two-factor authentication tools, while also having the capability to expand its target range through customizable configurations. Despite its efficient claims, it contains several vulnerabilities that offer detection opportunities for cybersecurity defenses.",
      "modified": "2025-12-21T11:15:42.376000",
      "created": "2025-12-21T11:15:42.376000",
      "tags": [
        "aurastealer",
        "key takeaways",
        "norton",
        "avast",
        "avira",
        "windows run",
        "lumma",
        "vidar"
      ],
      "references": [
        "https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        },
        {
          "id": "Vidar",
          "display_name": "Vidar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 12,
        "domain": 27
      },
      "indicator_count": 45,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "160 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "cybertool.shop",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "cybertool.shop",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780200822.8209205
}