{ "type": "Domain", "indicator": "ewingconsulting.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ewingconsulting.com", "alexa": "http://www.alexa.com/siteinfo/ewingconsulting.com", "indicator": "ewingconsulting.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2410970880, "indicator": "ewingconsulting.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "64471fd255d928e6660c86f2", "name": "threat-intelligence/emotet_cta_20221006_iocs.csv at main \u00b7 infobloxopen/threat-intelligence \u00b7 GitHub", "description": "", "modified": "2023-04-25T00:33:22.846000", "created": "2023-04-25T00:33:22.846000", "tags": [ "website", "emotet payload", "dlls", "emotet c2", "dll payload", "github", "jump", "sign", "strong", "code issues", "star", "open", "emotet", "footer" ], "references": [ "https://github.com/infobloxopen/threat-intelligence/blob/main/cta_indicators/emotet_cta_20221006_iocs.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "satyagunupuru", "id": "220559", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 28, "URL": 164, "domain": 51, "hostname": 35 }, "indicator_count": 278, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64471fd034b53c35e6d35cab", "name": "threat-intelligence/emotet_cta_20221006_iocs.csv at main \u00b7 infobloxopen/threat-intelligence \u00b7 GitHub", "description": "", "modified": "2023-04-25T00:33:18.317000", "created": "2023-04-25T00:33:18.317000", "tags": [ "website", "emotet payload", "dlls", "emotet c2", "dll payload", "github", "jump", "sign", "strong", "code issues", "star", "open", "emotet", "footer" ], "references": [ "https://github.com/infobloxopen/threat-intelligence/blob/main/cta_indicators/emotet_cta_20221006_iocs.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "satyagunupuru", "id": "220559", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 28, "URL": 164, "domain": 51, "hostname": 35 }, "indicator_count": 278, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "637bb9ac9d24185080cd3fda", "name": "Notorious Emotet Malware", "description": "", "modified": "2022-12-21T17:00:02.336000", "created": "2022-11-21T17:47:24.210000", "tags": [ "emotet payload", "dll download", "emotet c", "c ip", "emotet", "strong", "january", "october", "june", "july", "april", "august", "february", "indonesia", "contact", "ukraine" ], "references": [ "https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/emotet-a-malware-family-that-keeps-going/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mohammedkaif_98", "id": "214759", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 60, "hostname": 51, "URL": 1 }, "indicator_count": 112, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1257 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62c4270ee0953324a98d21f8", "name": "Emotet IOCs", "description": "Researchers are trying to work out how to identify and identify a group of 10,000 people who are at risk of being killed by a single single shot, using a high-powered shotgun..", "modified": "2022-08-04T00:01:35.847000", "created": "2022-07-05T11:57:02.480000", "tags": [ "jccb", "public key", "sha256", "family", "size", "10 md5", "sha1", "sha512", "xlm extracted", "source call", "score", "urls https", "filesize", "process" ], "references": [ "https://twitter.com/bomccss/status/1544105990676959232" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 2, "FileHash-MD5": 4, "FileHash-SHA1": 4, "FileHash-SHA256": 4, "URL": 90 }, "indicator_count": 108, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1396 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc615dc7b8b97203bdebb1", "name": "Emotet IOCs", "description": "The full text of the report on cyber-attack on the European Union (EU) has been published online by RGSGK, the UK-based organisation that monitors the spread of terror online.", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T14:27:41.157000", "tags": [ "jjccbb", "emotet payload", "hashes", "xls file", "identification", "emotet", "zip file", "metadata author", "rgsgk excel4", "macros call" ], "references": [ "https://twitter.com/executemalware/status/1541894741578719234" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "domain": 5, "FileHash-MD5": 9, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "email": 13 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1402 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc615e1c493b080fd618e7", "name": "Emotet IOCs", "description": "The full text of the report on cyber-attack on the European Union (EU) has been published online by RGSGK, the UK-based organisation that monitors the spread of terror online.", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T14:27:42.267000", "tags": [ "jjccbb", "emotet payload", "hashes", "xls file", "identification", "emotet", "zip file", "metadata author", "rgsgk excel4", "macros call" ], "references": [ "https://twitter.com/executemalware/status/1541894741578719234" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "domain": 5, "FileHash-MD5": 9, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "email": 13 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1402 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://twitter.com/executemalware/status/1541894741578719234", "https://github.com/infobloxopen/threat-intelligence/blob/main/cta_indicators/emotet_cta_20221006_iocs.csv", "https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/emotet-a-malware-family-that-keeps-going/", "https://twitter.com/bomccss/status/1544105990676959232" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "64471fd255d928e6660c86f2", "name": "threat-intelligence/emotet_cta_20221006_iocs.csv at main \u00b7 infobloxopen/threat-intelligence \u00b7 GitHub", "description": "", "modified": "2023-04-25T00:33:22.846000", "created": "2023-04-25T00:33:22.846000", "tags": [ "website", "emotet payload", "dlls", "emotet c2", "dll payload", "github", "jump", "sign", "strong", "code issues", "star", "open", "emotet", "footer" ], "references": [ "https://github.com/infobloxopen/threat-intelligence/blob/main/cta_indicators/emotet_cta_20221006_iocs.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "satyagunupuru", "id": "220559", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 28, "URL": 164, "domain": 51, "hostname": 35 }, "indicator_count": 278, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64471fd034b53c35e6d35cab", "name": "threat-intelligence/emotet_cta_20221006_iocs.csv at main \u00b7 infobloxopen/threat-intelligence \u00b7 GitHub", "description": "", "modified": "2023-04-25T00:33:18.317000", "created": "2023-04-25T00:33:18.317000", "tags": [ "website", "emotet payload", "dlls", "emotet c2", "dll payload", "github", "jump", "sign", "strong", "code issues", "star", "open", "emotet", "footer" ], "references": [ "https://github.com/infobloxopen/threat-intelligence/blob/main/cta_indicators/emotet_cta_20221006_iocs.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "satyagunupuru", "id": "220559", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 28, "URL": 164, "domain": 51, "hostname": 35 }, "indicator_count": 278, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "637bb9ac9d24185080cd3fda", "name": "Notorious Emotet Malware", "description": "", "modified": "2022-12-21T17:00:02.336000", "created": "2022-11-21T17:47:24.210000", "tags": [ "emotet payload", "dll download", "emotet c", "c ip", "emotet", "strong", "january", "october", "june", "july", "april", "august", "february", "indonesia", "contact", "ukraine" ], "references": [ "https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/emotet-a-malware-family-that-keeps-going/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mohammedkaif_98", "id": "214759", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 60, "hostname": 51, "URL": 1 }, "indicator_count": 112, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1257 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62c4270ee0953324a98d21f8", "name": "Emotet IOCs", "description": "Researchers are trying to work out how to identify and identify a group of 10,000 people who are at risk of being killed by a single single shot, using a high-powered shotgun..", "modified": "2022-08-04T00:01:35.847000", "created": "2022-07-05T11:57:02.480000", "tags": [ "jccb", "public key", "sha256", "family", "size", "10 md5", "sha1", "sha512", "xlm extracted", "source call", "score", "urls https", "filesize", "process" ], "references": [ "https://twitter.com/bomccss/status/1544105990676959232" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 2, "FileHash-MD5": 4, "FileHash-SHA1": 4, "FileHash-SHA256": 4, "URL": 90 }, "indicator_count": 108, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1396 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc615dc7b8b97203bdebb1", "name": "Emotet IOCs", "description": "The full text of the report on cyber-attack on the European Union (EU) has been published online by RGSGK, the UK-based organisation that monitors the spread of terror online.", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T14:27:41.157000", "tags": [ "jjccbb", "emotet payload", "hashes", "xls file", "identification", "emotet", "zip file", "metadata author", "rgsgk excel4", "macros call" ], "references": [ "https://twitter.com/executemalware/status/1541894741578719234" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "domain": 5, "FileHash-MD5": 9, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "email": 13 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1402 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc615e1c493b080fd618e7", "name": "Emotet IOCs", "description": "The full text of the report on cyber-attack on the European Union (EU) has been published online by RGSGK, the UK-based organisation that monitors the spread of terror online.", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T14:27:42.267000", "tags": [ "jjccbb", "emotet payload", "hashes", "xls file", "identification", "emotet", "zip file", "metadata author", "rgsgk excel4", "macros call" ], "references": [ "https://twitter.com/executemalware/status/1541894741578719234" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "domain": 5, "FileHash-MD5": 9, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "email": 13 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1402 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ewingconsulting.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ewingconsulting.com", "found": true, "verdict": "malicious", "url_count": 5, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://ewingconsulting.com/wp-includes/1sqrshC/", "status": "offline", "threat": "malware_download", "date_added": "2022-07-04", "tags": [ "dll", "emotet", "epoch4", "heodo" ] }, { "url": "https://ewingconsulting.com/wp-includes/B4ZzwwImcXf6w8/", "status": "offline", "threat": "malware_download", "date_added": "2022-06-28", "tags": [ "dll", "emotet", "epoch4", "heodo" ] }, { "url": "https://ewingconsulting.com/buy/Ewj7oYjhYQ/", "status": "offline", "threat": "malware_download", "date_added": "2022-06-20", "tags": [ "emotet", "epoch5", "exe", "heodo" ] }, { "url": "http://ewingconsulting.com/solutions/yM/", "status": "offline", "threat": "malware_download", "date_added": "2020-08-07", "tags": [ "doc", "emotet", "epoch3", "heodo", "Quakbot" ] }, { "url": "http://ewingconsulting.com/drupal/waw5mv82-6hatb-28925/", "status": "offline", "threat": "malware_download", "date_added": "2020-07-29", "tags": [ "doc", "emotet", "epoch3", "heodo" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780269482.7719903 }