{ "type": "Domain", "indicator": "frey2.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/frey2.com", "alexa": "http://www.alexa.com/siteinfo/frey2.com", "indicator": "frey2.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3669543669, "indicator": "frey2.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 17, "pulses": [ { "id": "656530c390f6908763d73f01", "name": "URLHaus data - 27-11-2023", "description": "", "modified": "2023-12-28T00:01:20.880000", "created": "2023-11-28T00:13:55.541000", "tags": [ "32-bit", "elf", "mips", "Mozi", "dropped-by-PrivateLoader", "encrypted", "SocGholish", "AgentTesla", "mirai", "x86-32", "hajime", "js", "32", "exe", "xworm", "AsyncRAT", "wsf", "glupteba", "IcedID", "TR", "RedLine", "img", "TA577", "xmrig", "Formbook", "opendir", "doc", "6056", "pw-6056", "remcos", "3305", "pw-3305", "1168", "pw-1168", "1220", "pw-1220", "5687", "pw-5687", "3701", "pw-3701", "2764", "pw-2764", "1682", "pw-1682", "7845", "pw-7845", "3276", "pw-3276", "6512", "pw-6512", "5674", "pw-5674", "3278", "pw-3278", "5621", "pw-5621", "2709", "pw-2709", "3691", "pw-3691", "1885", "pw-1885", "2023", "pw-2023", "1122", "pw-1122", "3939", "pw-3939", "1225", "pw-1225", "3289", "pw-3289", "RedLineStealer", "agenziaentrate", "geo", "geofenced", "ITA", "RemcosRAT", "bz", "revenge", "stego", "zgRAT", "GuLoader", "ascii", "hta", "zip", "dcrat", "Encoded", "vbs", "powershell", "ps", "rat", "1234", "Password-protected", "rar", "infostealer", "gz", "redir-302", "dropped-by-SmokeLoader", "Amadey", "iso", "android", "apk", "IRATA" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 62, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 443, "hostname": 51, "domain": 167 }, "indicator_count": 661, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "885 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65555ec42ae218264c863864", "name": "URLHaus data - 15-11-2023", "description": "", "modified": "2023-12-16T00:02:45.114000", "created": "2023-11-16T00:13:56.224000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "elf", "Mozi", "64", "32-bit", "mips", "mirai", "zip", "SocGholish", "hajime", "PowerShellDropboxStealer", "RedLine", "zgRAT", "djvu", "exe", "VoidRAT", "Amadey", "glupteba", "PrivateLoader", "smokeloader", "xmrig", "dll", "RecordBreaker", "123", "Password-protected", "vbs", "agenziaentrate", "RemcosRAT", "stego", "from-Ghostpulse", "includes-Lumma", "Pikabot", "TA577", "TR", "powershell", "PowerShellMeterpreterReverseTCPx64", "Raccoon", "risepro", "geo", "geofenced", "ITA", "DarkGate", "PureLogs", "dropped-by-SmokeLoader", "SystemBC", "AgentTesla", "Formbook", "ua-curl", "js", "rar", "remcos", "peng", "9842", "2023", "gafgyt", "shellscript", "njRAT", "32", "RedLineStealer", "Arechclient2" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 477, "domain": 255, "hostname": 23 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "897 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6539a0e073218b06f719d184", "name": "URLHaus data - 25-10-2023", "description": "", "modified": "2023-11-24T23:00:42.911000", "created": "2023-10-25T23:12:32.281000", "tags": [ "elf", "mirai", "32-bit", "mips", "Mozi", "SocGholish", "dropped-by-PrivateLoader", "encrypted", "RedLine", "Smoke Loader", "Stealc", "hajime", "zgRAT", "AgentTesla", "dll", "RecordBreaker", "doc", "vbs", "Pikabot", "TA577", "TR", "zip", "exe", "Loki", "RemcosRAT", "404TDS", "AsyncRAT", "js", "powershell", "PowerShellMeterpreterReverseTCPx64", "dcrat", "ibat21-duckdns-org", "Amadey", "dropped-by-amadey", "RedLineStealer", "ua-curl", "32", "renesas", "arm", "intel", "PowerPC", "motorola", "1234", "7z", "Password-protected", "script", "povertystealer", "MetaMorfo", "spybanker", "TelegramLogin", "dropped-by-SmokeLoader", "SystemBC", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 652, "hostname": 11, "domain": 297 }, "indicator_count": 960, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65384f1d7743e65d7684b256", "name": "URLHaus data - 24-10-2023", "description": "", "modified": "2023-11-23T23:00:14.487000", "created": "2023-10-24T23:11:25.789000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "64-bit", "mirai", "x86-64", "AsyncRAT", "exe", "dropped-by-PrivateLoader", "njRAT", "encrypted", "RedLine", "Rhadamanthys", "dll", "Stealc", "RedLineStealer", "discord", "infostealer", "pwd-beta", "Pikabot", "TA577", "TR", "zip", "AS_DELIS", "djvu", "Vidar", "MarsStealer", "hajime", "bookinggoogledrive", "hotel123", "pw-hotel123", "32", "sparc", "arm", "renesas", "intel", "PowerPC", "motorola", "shellscript", "ua-curl", "PrivateLoader", "risepro", "dropped-by-SmokeLoader", "LummaStealer", "RemcosRAT", "Amadey", "glupteba", "smokeloader", "xmrig", "AgentTesla", "ascii", "Encoded", "opendir", "doc", "vbs", "zgRAT", "Loki", "rat", "Formbook", "SystemBC", "android", "apk", "IRATA", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 72, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 677, "hostname": 123, "domain": 191 }, "indicator_count": 991, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "919 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652d64cd44f6394f02603fae", "name": "IcedID IOCs - @Cryptolaemus1 - #TA577", "description": "Cryptolaemus / pr0xylife\nhttps://twitter.com/Cryptolaemus1/status/1713953739575345299", "modified": "2023-11-15T16:03:36.709000", "created": "2023-10-16T16:29:01.977000", "tags": [ "icedid", "ping", "ta577", "exec", "c wo", "ping wo", "curl", "rundll32" ], "references": [ "https://github.com/pr0xylife/IcedID/blob/main/icedID_16.10.2023.txt" ], "public": 1, "adversary": "TA577", "targeted_countries": [], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 221, "domain": 171, "hostname": 1 }, "indicator_count": 397, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "927 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647a7abaa58ae84330f2cbdf", "name": "URLHaus data - 02-06-2023", "description": "", "modified": "2023-07-02T23:03:26.565000", "created": "2023-06-02T23:26:50.082000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "ArkeiStealer", "dropped-by-amadey", "RedLineStealer", "arm", "x86-32", "ddos-bot", "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip", "dll", "64", "exe", "zgRAT", "RemcosRAT", "Loki", "opendir", "doc", "pw-1515", "rar", "pw-2023", "pw-2022", "pw-333", "Obama266", "VoidRAT", "Quakbot", "qbot", "AgentTesla", "RTF", "encrypted", "GuLoader", "rat", "Stealc", "2022", "Password-protected", "1234", "7z", "njRAT", "shellscript", "32", "bashlite", "gafgyt", "renesas", "intel", "Rhadamanthys", "payloads", "viaSmokeLoader", "Smoke Loader", "dropped-by-PrivateLoader", "RedLine", "dcrat", "additionalpayloads", "raccoonv2", "RecordBreaker", "xworm", "Formbook" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 228, "hostname": 3 }, "indicator_count": 1230, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1063 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6477d79099035326786bca6e", "name": "URLHaus data - 31-05-2023", "description": "", "modified": "2023-06-30T23:02:10.939000", "created": "2023-05-31T23:26:08.882000", "tags": [ "elf", "Mozi", "32-bit", "mips", "mirai", "arm", "hajime", "PowerShellDiscordKeyLogger", "BB30", "geofenced", "js", "Qakbot", "USA", "zip", "dll", "Quakbot", "x86-32", "gafgyt", "exe", "Formbook", "opendir", "VoidRAT", "NetSupport", "rat", "32", "sparc", "motorola", "PowerPC", "Loki", "AgentTesla", "cutwail", "rdgn", "shellscript", "Amadey", "dropped-by-PrivateLoader", "RedLineStealer", "brt", "Gozi", "ISFB", "ITA", "ursnif", "Gh0stRAT", "ascii", "Encoded", "encrypted" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 399, "hostname": 7 }, "indicator_count": 1406, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1065 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6476857e1d456831af861636", "name": "URLHaus data - 30-05-2023", "description": "", "modified": "2023-06-29T23:00:59.158000", "created": "2023-05-30T23:23:42.146000", "tags": [ "32-bit", "arm", "elf", "Mozi", "hajime", "mips", "mirai", "geofenced", "js", "Obama265", "Qakbot", "USA", "zip", "BB30", "dll", "msi", "dropped-by-amadey", "exe", "njRAT", "Raccoon", "stealer", "third-party dll", "BatchDropperMEMZ", "ua-ps", "PHPWebShellMiniShell", "2022", "Password-protected", "CobaltStrike", "golang", "stager", "VoidRAT", "64", "Arechclient2", "CoinMiner", "dropped-by-PrivateLoader", "xmrig", "RedLineStealer", "AsyncRAT", "powershell", "rat", "encrypted", "PrivateLoader", "qbot", "ITA", "Quakbot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 609 }, "indicator_count": 1613, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1068 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6474a025e7830f86fcbda9ba", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.\n\nA DLL is a library file containing functions that can be used by more than one program at the same time. When an application is launched, it will attempt to load any required DLLs.\n\nIt does this by searching through specific Windows folders for the DLL and, when found, loads it. However, Windows applications will prioritize DLLs in the same folder as the executable, loading them before all others.", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-29T12:52:53.004000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 307, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 434, "modified_text": "1068 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646e9c4769f1500915e101c7", "name": "URLHaus data - 24-05-2023", "description": "", "modified": "2023-06-23T23:00:43.443000", "created": "2023-05-24T23:22:47.414000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "geofenced", "Obama264", "Qakbot", "USA", "wsf", "zip", "mirai", "hajime", "dropped-by-amadey", "exe", "Formbook", "AveMariaRAT", "rat", "opendir", "RemcosRAT", "discord", "infostealer", "BB29", "js", "dll", "RedLineStealer", "doc", "64-bit", "gafgyt", "x86-64", "banker", "BRA", "trojan", "dropped-by-SmokeLoader", "Astaroth", "ua-ps", "Quakbot", "Ngioweb", "ascii", "32", "intel", "encrypted", "pw-1515", "rar", "pw-1234", "shellscript", "ddos-bot", "GuLoader", "Loki", "1234", "7z", "Password-protected", "dropped-by-PrivateLoader", "RedLine", "AgentTesla", "Encoded", "RTF", "Pikabot", "pw-2022", "pw-2023", "RecordBreaker" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 576, "domain": 127, "hostname": 5 }, "indicator_count": 708, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1072 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646bf96a09aa71a1bd60fce5", "name": "URLHaus data - 22-05-2023", "description": "", "modified": "2023-06-23T22:19:18.469000", "created": "2023-05-22T23:23:22.337000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "32", "exe", "lucifer", "geofenced", "js", "Pikabot", "Qakbot", "USA", "dropped-by-PrivateLoader", "njRAT", "64", "hajime", "dll", "ua-ps", "dropped-by-SmokeLoader", "PowerPC", "intel", "renesas", "shellscript", "motorola", "sparc", "Stealc", "encrypted", "RedLine", "rat", "AgentTesla", "RecordBreaker", "NanoCore", "opendir", "ascii", "Encoded", "GuLoader", "QuasarRAT", "1234", "7z", "Password-protected", "CoinMiner", "Lumma", "LummaStealer", "pw-2023", "rar", "pw-2022", "pw-123", "xworm", "qbot", "Formbook", "RemcosRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 820, "domain": 345, "hostname": 4 }, "indicator_count": 1169, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1072 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646562323df8ec74e628e6a0", "name": "URLHaus data - 17-05-2023", "description": "", "modified": "2023-06-23T22:19:18.469000", "created": "2023-05-17T23:24:34.238000", "tags": [ "32-bit", "elf", "mips", "Mozi", "zip", "arm", "mirai", "shellscript", "1234", "7z", "Password-protected", "ascii", "NetSupport", "powershell", "ps", "rat", "dropped-by-PrivateLoader", "encrypted", "exe", "Formbook", "PowerShellDiscordKeyLogger", "BB28", "geofenced", "js", "Qakbot", "Quakbot", "USA", "qbot", "dropped-by-SmokeLoader", "Loki", "opendir", "RedLine", "RemcosRAT", "Arechclient2", "AgentTesla", "doc", "RedLineStealer", "LummaStealer", "ArkeiStealer", "dll", "Stealc", "dropped-by-amadey", "hajime", "ua-ps", "32", "gafgyt", "Lumma", "Amadey", "AsyncRAT", "lnk", "Vidar", "quasar", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 880, "hostname": 8, "domain": 355 }, "indicator_count": 1243, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1072 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64640f71292ec3dad3e443e0", "name": "URLHaus data - 16-05-2023", "description": "", "modified": "2023-05-16T23:19:13.634000", "created": "2023-05-16T23:19:13.634000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "hajime", "BB28", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "USA", "PowerShellSMTPKeyLogger", "32", "Amadey", "exe", "64", "pw-2023", "rar", "pw-2022", "dropped-by-PrivateLoader", "encrypted", "1234", "7z", "Password-protected", "pw-1515", "dll", "ua-ps" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 133, "domain": 614, "hostname": 1 }, "indicator_count": 1748, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1110 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6462be46411bb325b6da05e9", "name": "URLHaus data - 15-05-2023", "description": "", "modified": "2023-05-15T23:20:38.852000", "created": "2023-05-15T23:20:38.852000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "AsyncRAT", "exe", "mirai", "dropped-by-amadey", "hajime", "geofenced", "obama263", "Qakbot", "USA", "wsf", "zip", "dll", "BB28", "js", "1234", "7z", "Password-protected", "64-bit", "x86-64", "doc", "opendir", "ua-ps", "AgentTesla", "dropped-by-SmokeLoader", "RecordBreaker", "Formbook", "ascii", "NetSupport", "powershell", "ps1", "rat", "ps", "dropped-by-PrivateLoader", "xworm", "SocGholish", "TDS", "2023", "rar", "1375", "glupteba", "viaAmadey", "viaSmokeLoader", "unknown", "32", "RemcosRAT", "encrypted", "1515", "Ngioweb", "discord", "infostealer", "Vidar", "RedLine", "RedLineStealer", "Amadey" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 323, "domain": 544, "hostname": 10 }, "indicator_count": 1877, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "645d789f1dce2e8d9b7b749d", "name": "URLHaus data - 11-05-2023", "description": "", "modified": "2023-05-11T23:22:07.029000", "created": "2023-05-11T23:22:07.029000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "arm", "mirai", "exe", "njRAT", "32", "Smoke Loader", "MassLogger", "opendir", "SnakeKeylogger", "AgentTesla", "hta", "rat", "RevengeRAT", "additionalpayloads", "RaccoonStealer", "raccoonv2", "RecordBreaker", "NetSupport", "zip", "ascii", "powershell", "ps", "doc", "dcrat", "CoinMiner", "ArkeiStealer", "RedLineStealer", "Password-protected", "rar", "gafgyt", "BB27", "geofenced", "js", "Qakbot", "USA", "Quakbot", "dll", "ua-ps", "Encoded", "RemcosRAT", "encrypted", "1231", "dropped-by-PrivateLoader", "dropped-by-SmokeLoader", "1234", "7z", "qbot", "1515", "SocGholish", "AveMariaRAT", "shellscript", "sparc", "motorola", "renesas", "BlackGuard", "intel", "PowerPC", "iso", "64", "Amadey", "banker", "BRA", "downloader", "smuggling", "trojan", "GuLoader", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 911, "IPv4": 341, "domain": 265, "hostname": 10 }, "indicator_count": 1527, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1115 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://urlhaus.abuse.ch/browse/", "https://github.com/pr0xylife/IcedID/blob/main/icedID_16.10.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "TA577" ], "malware_families": [ "Icedid" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 17, "pulses": [ { "id": "656530c390f6908763d73f01", "name": "URLHaus data - 27-11-2023", "description": "", "modified": "2023-12-28T00:01:20.880000", "created": "2023-11-28T00:13:55.541000", "tags": [ "32-bit", "elf", "mips", "Mozi", "dropped-by-PrivateLoader", "encrypted", "SocGholish", "AgentTesla", "mirai", "x86-32", "hajime", "js", "32", "exe", "xworm", "AsyncRAT", "wsf", "glupteba", "IcedID", "TR", "RedLine", "img", "TA577", "xmrig", "Formbook", "opendir", "doc", "6056", "pw-6056", "remcos", "3305", "pw-3305", "1168", "pw-1168", "1220", "pw-1220", "5687", "pw-5687", "3701", "pw-3701", "2764", "pw-2764", "1682", "pw-1682", "7845", "pw-7845", "3276", "pw-3276", "6512", "pw-6512", "5674", "pw-5674", "3278", "pw-3278", "5621", "pw-5621", "2709", "pw-2709", "3691", "pw-3691", "1885", "pw-1885", "2023", "pw-2023", "1122", "pw-1122", "3939", "pw-3939", "1225", "pw-1225", "3289", "pw-3289", "RedLineStealer", "agenziaentrate", "geo", "geofenced", "ITA", "RemcosRAT", "bz", "revenge", "stego", "zgRAT", "GuLoader", "ascii", "hta", "zip", "dcrat", "Encoded", "vbs", "powershell", "ps", "rat", "1234", "Password-protected", "rar", "infostealer", "gz", "redir-302", "dropped-by-SmokeLoader", "Amadey", "iso", "android", "apk", "IRATA" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 62, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 443, "hostname": 51, "domain": 167 }, "indicator_count": 661, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "885 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65555ec42ae218264c863864", "name": "URLHaus data - 15-11-2023", "description": "", "modified": "2023-12-16T00:02:45.114000", "created": "2023-11-16T00:13:56.224000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "elf", "Mozi", "64", "32-bit", "mips", "mirai", "zip", "SocGholish", "hajime", "PowerShellDropboxStealer", "RedLine", "zgRAT", "djvu", "exe", "VoidRAT", "Amadey", "glupteba", "PrivateLoader", "smokeloader", "xmrig", "dll", "RecordBreaker", "123", "Password-protected", "vbs", "agenziaentrate", "RemcosRAT", "stego", "from-Ghostpulse", "includes-Lumma", "Pikabot", "TA577", "TR", "powershell", "PowerShellMeterpreterReverseTCPx64", "Raccoon", "risepro", "geo", "geofenced", "ITA", "DarkGate", "PureLogs", "dropped-by-SmokeLoader", "SystemBC", "AgentTesla", "Formbook", "ua-curl", "js", "rar", "remcos", "peng", "9842", "2023", "gafgyt", "shellscript", "njRAT", "32", "RedLineStealer", "Arechclient2" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 477, "domain": 255, "hostname": 23 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "897 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6539a0e073218b06f719d184", "name": "URLHaus data - 25-10-2023", "description": "", "modified": "2023-11-24T23:00:42.911000", "created": "2023-10-25T23:12:32.281000", "tags": [ "elf", "mirai", "32-bit", "mips", "Mozi", "SocGholish", "dropped-by-PrivateLoader", "encrypted", "RedLine", "Smoke Loader", "Stealc", "hajime", "zgRAT", "AgentTesla", "dll", "RecordBreaker", "doc", "vbs", "Pikabot", "TA577", "TR", "zip", "exe", "Loki", "RemcosRAT", "404TDS", "AsyncRAT", "js", "powershell", "PowerShellMeterpreterReverseTCPx64", "dcrat", "ibat21-duckdns-org", "Amadey", "dropped-by-amadey", "RedLineStealer", "ua-curl", "32", "renesas", "arm", "intel", "PowerPC", "motorola", "1234", "7z", "Password-protected", "script", "povertystealer", "MetaMorfo", "spybanker", "TelegramLogin", "dropped-by-SmokeLoader", "SystemBC", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 652, "hostname": 11, "domain": 297 }, "indicator_count": 960, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65384f1d7743e65d7684b256", "name": "URLHaus data - 24-10-2023", "description": "", "modified": "2023-11-23T23:00:14.487000", "created": "2023-10-24T23:11:25.789000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "64-bit", "mirai", "x86-64", "AsyncRAT", "exe", "dropped-by-PrivateLoader", "njRAT", "encrypted", "RedLine", "Rhadamanthys", "dll", "Stealc", "RedLineStealer", "discord", "infostealer", "pwd-beta", "Pikabot", "TA577", "TR", "zip", "AS_DELIS", "djvu", "Vidar", "MarsStealer", "hajime", "bookinggoogledrive", "hotel123", "pw-hotel123", "32", "sparc", "arm", "renesas", "intel", "PowerPC", "motorola", "shellscript", "ua-curl", "PrivateLoader", "risepro", "dropped-by-SmokeLoader", "LummaStealer", "RemcosRAT", "Amadey", "glupteba", "smokeloader", "xmrig", "AgentTesla", "ascii", "Encoded", "opendir", "doc", "vbs", "zgRAT", "Loki", "rat", "Formbook", "SystemBC", "android", "apk", "IRATA", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 72, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 677, "hostname": 123, "domain": 191 }, "indicator_count": 991, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "919 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652d64cd44f6394f02603fae", "name": "IcedID IOCs - @Cryptolaemus1 - #TA577", "description": "Cryptolaemus / pr0xylife\nhttps://twitter.com/Cryptolaemus1/status/1713953739575345299", "modified": "2023-11-15T16:03:36.709000", "created": "2023-10-16T16:29:01.977000", "tags": [ "icedid", "ping", "ta577", "exec", "c wo", "ping wo", "curl", "rundll32" ], "references": [ "https://github.com/pr0xylife/IcedID/blob/main/icedID_16.10.2023.txt" ], "public": 1, "adversary": "TA577", "targeted_countries": [], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 221, "domain": 171, "hostname": 1 }, "indicator_count": 397, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "927 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647a7abaa58ae84330f2cbdf", "name": "URLHaus data - 02-06-2023", "description": "", "modified": "2023-07-02T23:03:26.565000", "created": "2023-06-02T23:26:50.082000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "ArkeiStealer", "dropped-by-amadey", "RedLineStealer", "arm", "x86-32", "ddos-bot", "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip", "dll", "64", "exe", "zgRAT", "RemcosRAT", "Loki", "opendir", "doc", "pw-1515", "rar", "pw-2023", "pw-2022", "pw-333", "Obama266", "VoidRAT", "Quakbot", "qbot", "AgentTesla", "RTF", "encrypted", "GuLoader", "rat", "Stealc", "2022", "Password-protected", "1234", "7z", "njRAT", "shellscript", "32", "bashlite", "gafgyt", "renesas", "intel", "Rhadamanthys", "payloads", "viaSmokeLoader", "Smoke Loader", "dropped-by-PrivateLoader", "RedLine", "dcrat", "additionalpayloads", "raccoonv2", "RecordBreaker", "xworm", "Formbook" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 228, "hostname": 3 }, "indicator_count": 1230, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1063 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6477d79099035326786bca6e", "name": "URLHaus data - 31-05-2023", "description": "", "modified": "2023-06-30T23:02:10.939000", "created": "2023-05-31T23:26:08.882000", "tags": [ "elf", "Mozi", "32-bit", "mips", "mirai", "arm", "hajime", "PowerShellDiscordKeyLogger", "BB30", "geofenced", "js", "Qakbot", "USA", "zip", "dll", "Quakbot", "x86-32", "gafgyt", "exe", "Formbook", "opendir", "VoidRAT", "NetSupport", "rat", "32", "sparc", "motorola", "PowerPC", "Loki", "AgentTesla", "cutwail", "rdgn", "shellscript", "Amadey", "dropped-by-PrivateLoader", "RedLineStealer", "brt", "Gozi", "ISFB", "ITA", "ursnif", "Gh0stRAT", "ascii", "Encoded", "encrypted" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 399, "hostname": 7 }, "indicator_count": 1406, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1065 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6476857e1d456831af861636", "name": "URLHaus data - 30-05-2023", "description": "", "modified": "2023-06-29T23:00:59.158000", "created": "2023-05-30T23:23:42.146000", "tags": [ "32-bit", "arm", "elf", "Mozi", "hajime", "mips", "mirai", "geofenced", "js", "Obama265", "Qakbot", "USA", "zip", "BB30", "dll", "msi", "dropped-by-amadey", "exe", "njRAT", "Raccoon", "stealer", "third-party dll", "BatchDropperMEMZ", "ua-ps", "PHPWebShellMiniShell", "2022", "Password-protected", "CobaltStrike", "golang", "stager", "VoidRAT", "64", "Arechclient2", "CoinMiner", "dropped-by-PrivateLoader", "xmrig", "RedLineStealer", "AsyncRAT", "powershell", "rat", "encrypted", "PrivateLoader", "qbot", "ITA", "Quakbot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 609 }, "indicator_count": 1613, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1068 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "frey2.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "frey2.com", "found": true, "verdict": "malicious", "url_count": 19, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://frey2.com/art/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-28", "tags": [ "TR" ] }, { "url": "https://frey2.com/seet/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-27", "tags": [ "TR" ] }, { "url": "https://frey2.com/ai/", "status": "offline", "threat": "malware_download", "date_added": "2023-11-15", "tags": [ "Pikabot", "TA577", "TR", "zip" ] }, { "url": "https://frey2.com/tvei/", "status": "offline", "threat": "malware_download", "date_added": "2023-10-25", "tags": [ "Pikabot", "TA577", "TR" ] }, { "url": "https://frey2.com/lt/", "status": "offline", "threat": "malware_download", "date_added": "2023-10-24", "tags": [ "Pikabot", "TA577", "TR" ] }, { "url": "https://frey2.com/umee/", "status": "offline", "threat": "malware_download", "date_added": "2023-10-18", "tags": [ "Pikabot", "TA577", "TR" ] }, { "url": "https://frey2.com/eemo/", "status": "offline", "threat": "malware_download", "date_added": "2023-10-16", "tags": [ "IcedID", "TR" ] }, { "url": "https://frey2.com/ipt/", "status": "offline", "threat": "malware_download", "date_added": "2023-06-02", "tags": [ "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip" ] }, { "url": "https://frey2.com/one/", "status": "offline", "threat": "malware_download", "date_added": "2023-06-02", "tags": [ "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip" ] }, { "url": "https://frey2.com/elvq/", "status": "offline", "threat": "malware_download", "date_added": "2023-06-01", "tags": [ "BB30", "geofenced", "js", "Qakbot", "USA", "zip" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780235578.1555 }