{ "type": "Domain", "indicator": "facilityprint.com.br", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/facilityprint.com.br", "alexa": "http://www.alexa.com/siteinfo/facilityprint.com.br", "indicator": "facilityprint.com.br", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3667340280, "indicator": "facilityprint.com.br", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "648a05ac73d79f1058f9dd4c", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:40.932000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1051 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ad626f086ff24465fb", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:41.081000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "1051 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64485ff0b2f6c879159d21be", "name": "URLHaus data - 25-04-2023", "description": "", "modified": "2023-04-25T23:19:12.468000", "created": "2023-04-25T23:19:12.468000", "tags": [ "geofenced", "obama256", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "32-bit", "elf", "mips", "Mozi", "bb25", "arm", "mirai", "hajime", "TA570", "TR", "dll", "ua-ps", "AgentTesla", "exe", "RecordBreaker", "ascii", "TA551", "discord", "infostealer", "dropped-by-SmokeLoader", "RedLineStealer", "1234", "7z", "Password-protected", "shellscript", "QuasarRAT", "Vidar", "vjw0rm", "AsyncRAT", "bat", "PS-Invoke-WebRequest", "VoidRAT", "RaccoonStealer", "1fb5168d70e6f17e81df66eb20260539", "534dea827f40e5e0727fcee72c884c61", "c2:171.22.30.164", "docx", "lokibot", "opendir", "powershell", "ps1", "Metasploit", "sh", "hta", "rat", "Encoded", "32", "RemcosRAT", "mimikatz", "sys", "bashlite", "gafgyt", "PowerPC", "64", "intel", "sparc", "renesas", "motorola", "encrypted", "script", "Amadey", "dropped-by-PrivateLoader", "reverse_base64", "xworm", "RedLine", "SocGholish", "N-W0rm" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 910, "domain": 430, "IPv4": 283, "hostname": 10 }, "indicator_count": 1633, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64470ef6172c01032a1fddb5", "name": "URLHaus data - 24-04-2023", "description": "", "modified": "2023-04-24T23:21:26.217000", "created": "2023-04-24T23:21:26.217000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "x86-32", "hajime", "ddos", "ddos-bot", "SocGholish", "bb25", "geofenced", "msi", "one", "Qakbot", "qbot", "Quakbot", "TR", "USA", "1234", "Password-protected", "rar", "zip", "discord", "infostealer", "exe", "njRAT", "a77cf18ea8737164d665e80d2bfd8ac8", "bat", "PS-Invoke-WebRequest", "0d04ed02613ad4f4817d09021cdf02a5", "AsyncRAT", "dropped-by-PrivateLoader", "shellscript", "Formbook", "dll", "RecordBreaker", "GBR", "ua-ps", "gafgyt", "obama255", "wsf", "VoidRAT", "32", "dropped-by-amadey", "RedLineStealer", "7z", "smokeloader", "Vidar", "motorola", "renesas", "PowerPC", "sparc", "intel", "64", "encrypted", "PrivateLoader", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 613, "IPv4": 315, "hostname": 15, "domain": 102 }, "indicator_count": 1045, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6441c83c8703ca65bec88bff", "name": "URLHaus data - 20-04-2023", "description": "", "modified": "2023-04-20T23:18:19.562000", "created": "2023-04-20T23:18:19.562000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "geofenced", "obama255", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "BB24", "dll", "ua-ps", "671", "hta", "TR", "AsyncRAT", "dropped-by-PrivateLoader", "exe", "encrypted", "RedLine", "obama254", "Loader", "SmokeLoaderPayload", "xworm", "shellscript", "gafgyt", "AgentTesla", "opendir", "1234", "7z", "Password-protected", "Vidar", "Stealc", "stealer", "LaplasClipper", "Formbook", "32", "ascii", "bash", "sh", "njRAT", "PrivateLoader", "Encoded", "dcrat", "SocGholish", "Loki", "bokbot", "IcedID" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 739, "IPv4": 280, "hostname": 8, "domain": 246 }, "indicator_count": 1273, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1136 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Qakbot" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "648a05ac73d79f1058f9dd4c", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:40.932000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1051 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ad626f086ff24465fb", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:41.081000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "1051 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64485ff0b2f6c879159d21be", "name": "URLHaus data - 25-04-2023", "description": "", "modified": "2023-04-25T23:19:12.468000", "created": "2023-04-25T23:19:12.468000", "tags": [ "geofenced", "obama256", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "32-bit", "elf", "mips", "Mozi", "bb25", "arm", "mirai", "hajime", "TA570", "TR", "dll", "ua-ps", "AgentTesla", "exe", "RecordBreaker", "ascii", "TA551", "discord", "infostealer", "dropped-by-SmokeLoader", "RedLineStealer", "1234", "7z", "Password-protected", "shellscript", "QuasarRAT", "Vidar", "vjw0rm", "AsyncRAT", "bat", "PS-Invoke-WebRequest", "VoidRAT", "RaccoonStealer", "1fb5168d70e6f17e81df66eb20260539", "534dea827f40e5e0727fcee72c884c61", "c2:171.22.30.164", "docx", "lokibot", "opendir", "powershell", "ps1", "Metasploit", "sh", "hta", "rat", "Encoded", "32", "RemcosRAT", "mimikatz", "sys", "bashlite", "gafgyt", "PowerPC", "64", "intel", "sparc", "renesas", "motorola", "encrypted", "script", "Amadey", "dropped-by-PrivateLoader", "reverse_base64", "xworm", "RedLine", "SocGholish", "N-W0rm" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 910, "domain": 430, "IPv4": 283, "hostname": 10 }, "indicator_count": 1633, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64470ef6172c01032a1fddb5", "name": "URLHaus data - 24-04-2023", "description": "", "modified": "2023-04-24T23:21:26.217000", "created": "2023-04-24T23:21:26.217000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "x86-32", "hajime", "ddos", "ddos-bot", "SocGholish", "bb25", "geofenced", "msi", "one", "Qakbot", "qbot", "Quakbot", "TR", "USA", "1234", "Password-protected", "rar", "zip", "discord", "infostealer", "exe", "njRAT", "a77cf18ea8737164d665e80d2bfd8ac8", "bat", "PS-Invoke-WebRequest", "0d04ed02613ad4f4817d09021cdf02a5", "AsyncRAT", "dropped-by-PrivateLoader", "shellscript", "Formbook", "dll", "RecordBreaker", "GBR", "ua-ps", "gafgyt", "obama255", "wsf", "VoidRAT", "32", "dropped-by-amadey", "RedLineStealer", "7z", "smokeloader", "Vidar", "motorola", "renesas", "PowerPC", "sparc", "intel", "64", "encrypted", "PrivateLoader", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 613, "IPv4": 315, "hostname": 15, "domain": 102 }, "indicator_count": 1045, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6441c83c8703ca65bec88bff", "name": "URLHaus data - 20-04-2023", "description": "", "modified": "2023-04-20T23:18:19.562000", "created": "2023-04-20T23:18:19.562000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "geofenced", "obama255", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "BB24", "dll", "ua-ps", "671", "hta", "TR", "AsyncRAT", "dropped-by-PrivateLoader", "exe", "encrypted", "RedLine", "obama254", "Loader", "SmokeLoaderPayload", "xworm", "shellscript", "gafgyt", "AgentTesla", "opendir", "1234", "7z", "Password-protected", "Vidar", "Stealc", "stealer", "LaplasClipper", "Formbook", "32", "ascii", "bash", "sh", "njRAT", "PrivateLoader", "Encoded", "dcrat", "SocGholish", "Loki", "bokbot", "IcedID" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 739, "IPv4": 280, "hostname": 8, "domain": 246 }, "indicator_count": 1273, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1136 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644076978d87ad5466702ac7", "name": "URLHaus data - 19-04-2023", "description": "", "modified": "2023-04-19T23:17:43.812000", "created": "2023-04-19T23:17:43.812000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "dll", "geofenced", "obama254", "Qakbot", "qbot", "Quakbot", "ua-ps", "USA", "arm", "PowerShellDiscordKeyLogger", "921", "BB24", "TR", "wsf", "zip", "exe", "njRAT", "AgentTesla", "opendir", "Loki", "encrypted", "rat", "RemcosRAT", "Formbook", "QuasarRAT", "NetSupport", "doc", "RedLineStealer", "Smoke Loader", "x86-32", "Amadey", "VoidRAT", "ViperSoftX", "shellscript", "ascii", "Encoded", "obama253", "32", "gafgyt", "AsyncRAT", "1234", "7z", "Password-protected", "cryptojacking", "miner", "dropped-by-PrivateLoader", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 267, "domain": 387, "hostname": 25 }, "indicator_count": 1679, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "facilityprint.com.br", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "facilityprint.com.br", "found": true, "verdict": "malicious", "url_count": 5, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://facilityprint.com.br/piee/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-14", "tags": [ "BB32", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://facilityprint.com.br/eut/nonnam.php", "status": "offline", "threat": "malware_download", "date_added": "2023-04-25", "tags": [ "bb25", "geofenced", "Qakbot", "qbot", "Quakbot", "TR", "USA", "wsf", "zip" ] }, { "url": "https://facilityprint.com.br/ttes/nonsimilique.php", "status": "offline", "threat": "malware_download", "date_added": "2023-04-24", "tags": [ "bb25", "geofenced", "msi", "one", "Qakbot", "qbot", "Quakbot", "TR", "USA" ] }, { "url": "https://facilityprint.com.br/fae/voluptatemsit.php", "status": "offline", "threat": "malware_download", "date_added": "2023-04-20", "tags": [ "671", "BB24", "geofenced", "hta", "Qakbot", "qbot", "Quakbot", "TR", "USA", "zip" ] }, { "url": "https://facilityprint.com.br/erue/utcumque.php", "status": "offline", "threat": "malware_download", "date_added": "2023-04-19", "tags": [ "921", "BB24", "geofenced", "Qakbot", "qbot", "Quakbot", "TR", "USA", "wsf", "zip" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780221962.1110075 }