{ "type": "Domain", "indicator": "electromart.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/electromart.com", "alexa": "http://www.alexa.com/siteinfo/electromart.com", "indicator": "electromart.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3594093869, "indicator": "electromart.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6494d9af7ab59d4d625c788e", "name": "URLHaus data - 22-06-2023", "description": "", "modified": "2023-07-22T23:03:05.613000", "created": "2023-06-22T23:30:55.222000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "dropped-by-amadey", "mirai", "geofenced", "js", "obama271", "Qakbot", "qbot", "Quakbot", "TR", "USA", "dll", "AsyncRAT", "exe", "ddos-bot", "njRAT", "encrypted", "GuLoader", "rat", "RemcosRAT", "zip", "Vidar", "ascii", "remcos", "dcrat", "Qbot", "Rhadamanthys", "32", "AgentTesla", "spyware", "1234", "7z", "Password-protected", "stealer", "NetSupport", "gafgyt", "64-bit", "x86-64", "VoidRAT", "intel", "renesas", "motorola", "PowerPC", "sparc", "64", "shellscript", "ee", "Formbook", "obam270", "TA570", "BB33", "Obama270", "x86-32", "Stealc", "RedLineStealer", "dropped-by-PrivateLoader", "RedLine", "opendir", "powershell", "ps1", "RTF", "SnakeKeylogger", "BatchDropperMEMZ" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 342, "hostname": 25 }, "indicator_count": 1366, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1043 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648cf21d49a36112f5c63ad8", "name": "URLHaus data - 16-06-2023", "description": "", "modified": "2023-07-16T23:03:38.959000", "created": "2023-06-16T23:37:01.362000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "32", "exe", "remcos", "powershell", "PowerShellMeterpreterReverseTCPx64", "arm", "njRAT", "dcrat", "CoinMiner", "dropped-by-PrivateLoader", "encrypted", "ascii", "hajime", "sparc", "renesas", "intel", "bashlite", "gafgyt", "64", "ArkeiStealer", "script", "PowerPC", "motorola", "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "AsyncRAT", "CAN", "ua-msi", "ua-2", "ua-w", "UA-fenced", "ua-mozilla-777", "ua-1", "dropped-by-amadey", "RedLineStealer", "dll", "RedLine", "PrivateLoader", "GBR" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 550, "hostname": 29 }, "indicator_count": 1579, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1049 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6476857e1d456831af861636", "name": "URLHaus data - 30-05-2023", "description": "", "modified": "2023-06-29T23:00:59.158000", "created": "2023-05-30T23:23:42.146000", "tags": [ "32-bit", "arm", "elf", "Mozi", "hajime", "mips", "mirai", "geofenced", "js", "Obama265", "Qakbot", "USA", "zip", "BB30", "dll", "msi", "dropped-by-amadey", "exe", "njRAT", "Raccoon", "stealer", "third-party dll", "BatchDropperMEMZ", "ua-ps", "PHPWebShellMiniShell", "2022", "Password-protected", "CobaltStrike", "golang", "stager", "VoidRAT", "64", "Arechclient2", "CoinMiner", "dropped-by-PrivateLoader", "xmrig", "RedLineStealer", "AsyncRAT", "powershell", "rat", "encrypted", "PrivateLoader", "qbot", "ITA", "Quakbot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 609 }, "indicator_count": 1613, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6494d9af7ab59d4d625c788e", "name": "URLHaus data - 22-06-2023", "description": "", "modified": "2023-07-22T23:03:05.613000", "created": "2023-06-22T23:30:55.222000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "dropped-by-amadey", "mirai", "geofenced", "js", "obama271", "Qakbot", "qbot", "Quakbot", "TR", "USA", "dll", "AsyncRAT", "exe", "ddos-bot", "njRAT", "encrypted", "GuLoader", "rat", "RemcosRAT", "zip", "Vidar", "ascii", "remcos", "dcrat", "Qbot", "Rhadamanthys", "32", "AgentTesla", "spyware", "1234", "7z", "Password-protected", "stealer", "NetSupport", "gafgyt", "64-bit", "x86-64", "VoidRAT", "intel", "renesas", "motorola", "PowerPC", "sparc", "64", "shellscript", "ee", "Formbook", "obam270", "TA570", "BB33", "Obama270", "x86-32", "Stealc", "RedLineStealer", "dropped-by-PrivateLoader", "RedLine", "opendir", "powershell", "ps1", "RTF", "SnakeKeylogger", "BatchDropperMEMZ" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 342, "hostname": 25 }, "indicator_count": 1366, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1043 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648cf21d49a36112f5c63ad8", "name": "URLHaus data - 16-06-2023", "description": "", "modified": "2023-07-16T23:03:38.959000", "created": "2023-06-16T23:37:01.362000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "32", "exe", "remcos", "powershell", "PowerShellMeterpreterReverseTCPx64", "arm", "njRAT", "dcrat", "CoinMiner", "dropped-by-PrivateLoader", "encrypted", "ascii", "hajime", "sparc", "renesas", "intel", "bashlite", "gafgyt", "64", "ArkeiStealer", "script", "PowerPC", "motorola", "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "AsyncRAT", "CAN", "ua-msi", "ua-2", "ua-w", "UA-fenced", "ua-mozilla-777", "ua-1", "dropped-by-amadey", "RedLineStealer", "dll", "RedLine", "PrivateLoader", "GBR" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 550, "hostname": 29 }, "indicator_count": 1579, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1049 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6476857e1d456831af861636", "name": "URLHaus data - 30-05-2023", "description": "", "modified": "2023-06-29T23:00:59.158000", "created": "2023-05-30T23:23:42.146000", "tags": [ "32-bit", "arm", "elf", "Mozi", "hajime", "mips", "mirai", "geofenced", "js", "Obama265", "Qakbot", "USA", "zip", "BB30", "dll", "msi", "dropped-by-amadey", "exe", "njRAT", "Raccoon", "stealer", "third-party dll", "BatchDropperMEMZ", "ua-ps", "PHPWebShellMiniShell", "2022", "Password-protected", "CobaltStrike", "golang", "stager", "VoidRAT", "64", "Arechclient2", "CoinMiner", "dropped-by-PrivateLoader", "xmrig", "RedLineStealer", "AsyncRAT", "powershell", "rat", "encrypted", "PrivateLoader", "qbot", "ITA", "Quakbot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 609 }, "indicator_count": 1613, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "electromart.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "electromart.com", "found": true, "verdict": "malicious", "url_count": 5, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://electromart.com/qah/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-22", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA" ] }, { "url": "https://electromart.com/ir/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-16", "tags": [ "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA" ] }, { "url": "https://electromart.com/tium/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-30", "tags": [ "BB30", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://electromart.com/oims/assumendaet.php", "status": "offline", "threat": "malware_download", "date_added": "2023-04-19", "tags": [ "921", "BB24", "geofenced", "Qakbot", "qbot", "Quakbot", "TR", "USA", "wsf", "zip" ] }, { "url": "https://electromart.com/siu/index.php?qakbot.zip", "status": "offline", "threat": "malware_download", "date_added": "2022-11-28", "tags": [ "BB08", "iso", "P32M", "Qakbot", "qbot", "Quakbot", "TR", "zip" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780221957.870271 }