{ "type": "Domain", "indicator": "flash-player-update.digital", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/flash-player-update.digital", "alexa": "http://www.alexa.com/siteinfo/flash-player-update.digital", "indicator": "flash-player-update.digital", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2908440437, "indicator": "flash-player-update.digital", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "60ca189478da06f3f78160b5", "name": "Matanbuchus: New Malware-as-a-Service Loader", "description": "In February 2021, BelialDemon advertised a new malware-as-a-service (MaaS) called Matanbuchus Loader and charged an initial rental price of $2,500. Malware loaders are malicious software that typically drop or pull down second-stage malware from command and control (C2) infrastructures.", "modified": "2021-06-16T16:33:55.466000", "created": "2021-06-16T15:28:20.009000", "tags": [ "matanbuchus", "belialdemon", "malicious document", "Malware-as-a-Service" ], "references": [ "https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" } ], "industries": [ "Education", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 213, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA256": 3, "FileHash-SHA1": 2, "domain": 33, "hostname": 2, "URL": 3 }, "indicator_count": 45, "is_author": false, "is_subscribing": null, "subscriber_count": 386531, "modified_text": "1809 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6889ff2cfa6a2c08cb85336a", "name": "EbeeJuly2025 Pt2", "description": "IOCs of multiple threaats observed and collected in July 2025", "modified": "2025-08-29T10:02:20.542000", "created": "2025-07-30T11:17:00.302000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "FileHash-MD5": 177, "FileHash-SHA1": 132, "FileHash-SHA256": 216, "domain": 136, "email": 1, "hostname": 101 }, "indicator_count": 828, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "275 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "676c6a9534b2c6b35936ae5f", "name": "Phishing Army Blocklist Extended", "description": "", "modified": "2024-12-25T20:27:00.473000", "created": "2024-12-25T20:27:00.473000", "tags": [], "references": [ "https://phishing.army/download/phishing_army_blocklist_extended.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6491, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 3, "domain": 132719, "hostname": 128543 }, "indicator_count": 267758, "is_author": false, "is_subscribing": null, "subscriber_count": 207, "modified_text": "521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655e49bf7fb5ebc444e8db6a", "name": "DGA by Cybsec", "description": "", "modified": "2023-12-22T18:04:37.131000", "created": "2023-11-22T18:34:39.799000", "tags": [ "DGA" ], "references": [ "https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Libfy", "id": "14964", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4359, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 1, "domain": 76669, "hostname": 85783 }, "indicator_count": 166814, "is_author": false, "is_subscribing": null, "subscriber_count": 102, "modified_text": "890 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655e4ad4441b4cd4352a4cb2", "name": "DGA by Cybsec", "description": "", "modified": "2023-12-22T18:04:37.131000", "created": "2023-11-22T18:39:16.220000", "tags": [ "DGA" ], "references": [ "https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Libfy", "id": "14964", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4359, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 1, "domain": 76669, "hostname": 85783 }, "indicator_count": 166814, "is_author": false, "is_subscribing": null, "subscriber_count": 106, "modified_text": "890 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62b579d76794827a674c6024", "name": "NewDom-1-20220624", "description": "ICANN-Dom", "modified": "2022-08-08T00:02:35.906000", "created": "2022-06-24T08:46:15.236000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1392 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "62b57a356ad4f268079d787d", "name": "NewDom-1-20220624", "description": "ICANN-Dom", "modified": "2022-08-08T00:02:35.906000", "created": "2022-06-24T08:47:49.865000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1392 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "62b07f6ec6971c3ab65e0cc8", "name": "Malspam pushes Matanbuchus malware, leads to Cobalt Strike - SANS Internet Storm Center", "description": "Security researchers have noticed a new malicious spam campaign that delivers the 'Matanbuchus' malware to drop Cobalt Strike beacons on compromised machines.\n\nCobalt Strike is a penetration testing suite that is frequently used by threat actors for lateral movement and to drop additional payloads.\n\nMatanbuchus is a malware-as-a-service (MaaS) project first spotted in February 2021 in advertisements on the dark web promoting it as a $2,500 loader that launches executables directly into system memory.", "modified": "2022-07-20T00:04:04.226000", "created": "2022-06-20T14:08:46.710000", "tags": [ "matanbuchus", "belialdemon", "dlls", "sha256", "matanbuchus dll", "excel", "february", "belial", "powershell", "microsoft excel", "wildfire", "malware", "team", "twitter", "cobalt strike", "file size", "file type", "sha256 hash", "file location", "html file", "https traffic", "windows host", "pe32", "intel" ], "references": [ "https://isc.sans.edu/forums/diary/Malspam+pushes+Matanbuchus+malware+leads+to+Cobalt+Strike/28752/", "https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/", "https://www.bleepingcomputer.com/news/security/new-phishing-attack-infects-devices-with-cobalt-strike/" ], "public": 1, "adversary": "", "targeted_countries": [ "Belgium", "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 272, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 4, "FileHash-SHA256": 38, "URL": 11, "domain": 37, "hostname": 2 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 433, "modified_text": "1411 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://isc.sans.edu/forums/diary/Malspam+pushes+Matanbuchus+malware+leads+to+Cobalt+Strike/28752/", "https://phishing.army/download/phishing_army_blocklist_extended.txt", "https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/", "https://www.bleepingcomputer.com/news/security/new-phishing-attack-infects-devices-with-cobalt-strike/", "https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Matanbuchus" ], "industries": [ "Education", "Technology" ] }, "other": { "adversary": [], "malware_families": [ "Cobalt strike", "Matanbuchus" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "60ca189478da06f3f78160b5", "name": "Matanbuchus: New Malware-as-a-Service Loader", "description": "In February 2021, BelialDemon advertised a new malware-as-a-service (MaaS) called Matanbuchus Loader and charged an initial rental price of $2,500. Malware loaders are malicious software that typically drop or pull down second-stage malware from command and control (C2) infrastructures.", "modified": "2021-06-16T16:33:55.466000", "created": "2021-06-16T15:28:20.009000", "tags": [ "matanbuchus", "belialdemon", "malicious document", "Malware-as-a-Service" ], "references": [ "https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" } ], "industries": [ "Education", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 213, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA256": 3, "FileHash-SHA1": 2, "domain": 33, "hostname": 2, "URL": 3 }, "indicator_count": 45, "is_author": false, "is_subscribing": null, "subscriber_count": 386531, "modified_text": "1809 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6889ff2cfa6a2c08cb85336a", "name": "EbeeJuly2025 Pt2", "description": "IOCs of multiple threaats observed and collected in July 2025", "modified": "2025-08-29T10:02:20.542000", "created": "2025-07-30T11:17:00.302000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "FileHash-MD5": 177, "FileHash-SHA1": 132, "FileHash-SHA256": 216, "domain": 136, "email": 1, "hostname": 101 }, "indicator_count": 828, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "275 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "676c6a9534b2c6b35936ae5f", "name": "Phishing Army Blocklist Extended", "description": "", "modified": "2024-12-25T20:27:00.473000", "created": "2024-12-25T20:27:00.473000", "tags": [], "references": [ "https://phishing.army/download/phishing_army_blocklist_extended.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6491, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 3, "domain": 132719, "hostname": 128543 }, "indicator_count": 267758, "is_author": false, "is_subscribing": null, "subscriber_count": 207, "modified_text": "521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655e49bf7fb5ebc444e8db6a", "name": "DGA by Cybsec", "description": "", "modified": "2023-12-22T18:04:37.131000", "created": "2023-11-22T18:34:39.799000", "tags": [ "DGA" ], "references": [ "https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Libfy", "id": "14964", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4359, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 1, "domain": 76669, "hostname": 85783 }, "indicator_count": 166814, "is_author": false, "is_subscribing": null, "subscriber_count": 102, "modified_text": "890 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655e4ad4441b4cd4352a4cb2", "name": "DGA by Cybsec", "description": "", "modified": "2023-12-22T18:04:37.131000", "created": "2023-11-22T18:39:16.220000", "tags": [ "DGA" ], "references": [ "https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Libfy", "id": "14964", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4359, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 1, "domain": 76669, "hostname": 85783 }, "indicator_count": 166814, "is_author": false, "is_subscribing": null, "subscriber_count": 106, "modified_text": "890 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62b579d76794827a674c6024", "name": "NewDom-1-20220624", "description": "ICANN-Dom", "modified": "2022-08-08T00:02:35.906000", "created": "2022-06-24T08:46:15.236000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1392 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "62b57a356ad4f268079d787d", "name": "NewDom-1-20220624", "description": "ICANN-Dom", "modified": "2022-08-08T00:02:35.906000", "created": "2022-06-24T08:47:49.865000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1392 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "62b07f6ec6971c3ab65e0cc8", "name": "Malspam pushes Matanbuchus malware, leads to Cobalt Strike - SANS Internet Storm Center", "description": "Security researchers have noticed a new malicious spam campaign that delivers the 'Matanbuchus' malware to drop Cobalt Strike beacons on compromised machines.\n\nCobalt Strike is a penetration testing suite that is frequently used by threat actors for lateral movement and to drop additional payloads.\n\nMatanbuchus is a malware-as-a-service (MaaS) project first spotted in February 2021 in advertisements on the dark web promoting it as a $2,500 loader that launches executables directly into system memory.", "modified": "2022-07-20T00:04:04.226000", "created": "2022-06-20T14:08:46.710000", "tags": [ "matanbuchus", "belialdemon", "dlls", "sha256", "matanbuchus dll", "excel", "february", "belial", "powershell", "microsoft excel", "wildfire", "malware", "team", "twitter", "cobalt strike", "file size", "file type", "sha256 hash", "file location", "html file", "https traffic", "windows host", "pe32", "intel" ], "references": [ "https://isc.sans.edu/forums/diary/Malspam+pushes+Matanbuchus+malware+leads+to+Cobalt+Strike/28752/", "https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/", "https://www.bleepingcomputer.com/news/security/new-phishing-attack-infects-devices-with-cobalt-strike/" ], "public": 1, "adversary": "", "targeted_countries": [ "Belgium", "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 272, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 4, "FileHash-SHA256": 38, "URL": 11, "domain": 37, "hostname": 2 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 433, "modified_text": "1411 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "flash-player-update.digital", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "flash-player-update.digital", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780231893.6219761 }