{ "type": "Domain", "indicator": "genbicta.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/genbicta.com", "alexa": "http://www.alexa.com/siteinfo/genbicta.com", "indicator": "genbicta.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2977489169, "indicator": "genbicta.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 15, "pulses": [ { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708e8a2deb7fd89b09d554", "name": "IOCs - 20225201339", "description": "", "modified": "2023-12-06T15:08:58.372000", "created": "2023-12-06T15:08:58.372000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1955, "FileHash-SHA256": 839, "FilePath": 1955, "Mutex": 1955, "YARA": 1955, "domain": 179, "URL": 9566, "hostname": 297, "FileHash-SHA1": 4792 }, "indicator_count": 23493, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708dc60765663247bf0c35", "name": "IOCs - 2022511143", "description": "", "modified": "2023-12-06T15:05:41.998000", "created": "2023-12-06T15:05:41.998000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1944, "FileHash-SHA256": 836, "FilePath": 1944, "Mutex": 1944, "YARA": 1944, "URL": 9710, "domain": 172, "hostname": 283, "FileHash-SHA1": 4778 }, "indicator_count": 23555, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707d14ff2377852bad6d80", "name": "Azorult Malware Analysis, Overview by ANY.RUN", "description": "", "modified": "2023-12-06T13:54:28.047000", "created": "2023-12-06T13:54:28.047000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 17, "hostname": 2, "FileHash-SHA256": 21, "FileHash-MD5": 13, "FileHash-SHA1": 12, "URL": 1 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "638dcbd385c4c8b071d944fe", "name": "Threat Intel Report - W50-2022.pdf", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly based recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-01-04T10:01:53.783000", "created": "2022-12-05T10:45:39.829000", "tags": [], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_ Real-time", "https://www.dnsbl.info/", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 101, "CVE": 1, "FileHash-MD5": 10, "FileHash-SHA1": 10, "FileHash-SHA256": 13, "domain": 20, "hostname": 33 }, "indicator_count": 188, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "1242 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6317137bd474b32c0162c595", "name": "Threat Intel Report - W37-2022", "description": "", "modified": "2022-10-06T00:00:46.407000", "created": "2022-09-06T09:31:39.761000", "tags": [], "references": [ "TechM-Threat Intel Report - W37-2022.pdf" ], "public": 1, "adversary": "Threat Intel Report - W37-2022", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 59, "hostname": 58, "URL": 71, "FileHash-MD5": 8, "FileHash-SHA1": 9, "FileHash-SHA256": 14, "CVE": 1 }, "indicator_count": 220, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "1332 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6304f3ff75ddd692ffa71953", "name": "Cyber Threat IOCs_Week35_2022", "description": "Here is a full list of links to the malware that has infected more than 200,000 people in the past two weeks and is being investigated by the UK's National Security Agency (NSA).", "modified": "2022-09-22T00:02:31.511000", "created": "2022-08-23T15:36:31.988000", "tags": [ "hashes domains", "netherlands", "romania", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "paraguay", "algeria", "remcosrat", "mozi", "asyncrat exe", "arechclient2", "redlinestealer", "loader quakbot", "rm3 xlsb", "loader rm3", "netsupport", "irata", "date", "malware url", "tags", "formbook", "neshta", "azorult", "asyncrat" ], "references": [], "public": 1, "adversary": "Cyber Threat IOCs_Week35_2022", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 47, "FileHash-SHA1": 47, "FileHash-SHA256": 109, "domain": 45, "URL": 41, "hostname": 56 }, "indicator_count": 345, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "1346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a7261459933cde712b", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:27.524000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1433 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a874a16678d3b6bef0", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:28.111000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1433 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6287fc9f53079ef212677f2d", "name": "IOCs - 20225201339", "description": "For complete list please visit https://apd.altervista.org/", "modified": "2022-06-19T20:03:12.081000", "created": "2022-05-20T20:39:59.698000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1955, "FilePath": 1955, "Mutex": 1955, "YARA": 1955, "URL": 9566, "FileHash-SHA256": 839, "hostname": 297, "domain": 179, "FileHash-SHA1": 4792 }, "indicator_count": 23493, "is_author": false, "is_subscribing": null, "subscriber_count": 422, "modified_text": "1441 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627c250b4e0245bfb27f6965", "name": "IOCs - 2022511143", "description": "For complete list please visit https://apd.altervista.org/", "modified": "2022-06-10T21:01:36.599000", "created": "2022-05-11T21:05:15.155000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1944, "FilePath": 1944, "Mutex": 1944, "YARA": 1944, "URL": 9710, "FileHash-SHA256": 836, "hostname": 283, "domain": 172, "FileHash-SHA1": 4778 }, "indicator_count": 23555, "is_author": false, "is_subscribing": null, "subscriber_count": 425, "modified_text": "1450 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6211d35c9626605ef7c962d1", "name": "Zloader Malware Analysis, Overview by ANY.RUN", "description": "Zloader is a banking trojan that uses webinjects and VNC clients to steal the passwords of its victims, but has seen a surge in activity since its first appearance in 2016.", "modified": "2022-03-22T00:00:12.890000", "created": "2022-02-20T05:36:28.754000", "tags": [ "remote access", "zeus", "zeus banking", "zloader", "agent tesla", "ave maria", "warzone", "danabot", "zloader malware", "hancitor", "march", "command", "terdot", "zbot", "zeus malware", "zeus code", "researchers", "trojan", "loader", "panda banker", "flawedammyy" ], "references": [ "https://any.run/malware-trends/zloader" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "Canada" ], "malware_families": [ { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "Danabot", "display_name": "Danabot", "target": null }, { "id": "WARZONE", "display_name": "WARZONE", "target": null }, { "id": "Ave Maria", "display_name": "Ave Maria", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Zloader", "display_name": "Zloader", "target": null }, { "id": "Zeus Banking", "display_name": "Zeus Banking", "target": null }, { "id": "ZeuS", "display_name": "ZeuS", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" } ], "industries": [ "Military", "Banking", "Financial" ], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "santhosh.kumar", "id": "175772", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 15, "FileHash-SHA1": 15, "FileHash-SHA256": 21, "URL": 1, "domain": 12, "hostname": 9 }, "indicator_count": 73, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "1530 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61ef8275ac49a6c4331694eb", "name": "Azorult Malware Analysis, Overview by ANY.RUN", "description": "Azorult, a trojan that can steal banking information and cryptocurrency, has been identified by researchers as one of the world's most serious cyber-thieves, and now researchers are looking to track its movements.", "modified": "2022-02-24T00:00:20.162000", "created": "2022-01-25T04:54:13.398000", "tags": [ "azorult", "remote access", "hermes", "agent tesla", "ave maria", "warzone", "danabot", "july", "trojan", "azorult malware", "azorult stealer", "proofpoint", "chthonic", "october", "a trojan", "hawkeye", "aurora", "adwind", "remcos" ], "references": [ "https://any.run/malware-trends/azorult" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "Danabot", "display_name": "Danabot", "target": null }, { "id": "WARZONE", "display_name": "WARZONE", "target": null }, { "id": "Ave Maria", "display_name": "Ave Maria", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Azorult", "display_name": "Azorult", "target": null }, { "id": "Hermes", "display_name": "Hermes", "target": null } ], "attack_ids": [ { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Military" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "teja.batchu@sisainfosec.com", "id": "176081", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "FileHash-MD5": 13, "FileHash-SHA1": 12, "FileHash-SHA256": 21, "CVE": 1, "domain": 17, "hostname": 2 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "1556 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e973e7c8ba785f5c4d3b29", "name": "SAMA_IOC", "description": "We are added the IOCs", "modified": "2022-02-19T00:03:23.595000", "created": "2022-01-20T14:38:31.439000", "tags": [], "references": [ "HASH GSOC IOCs.txt 2.txt", "DOMAIN GSOC IOCs.txt2.txt", "IP GSOC IOCs.txt2.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "TamweelSec", "id": "138946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 15, "FileHash-SHA1": 15, "FileHash-SHA256": 21, "domain": 23, "hostname": 22 }, "indicator_count": 96, "is_author": false, "is_subscribing": null, "subscriber_count": 43, "modified_text": "1561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.spamhaus.org/xbl/", "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_ Real-time", "DOMAIN GSOC IOCs.txt2.txt", "IP GSOC IOCs.txt2.txt", "TechM-Threat Intel Report - W37-2022.pdf", "HASH GSOC IOCs.txt 2.txt", "https://any.run/malware-trends/azorult", "Tasheel Finance IOCs.txt", "https://www.dnsbl.info/", "https://any.run/malware-trends/zloader" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Cyber Threat IOCs_Week35_2022", "Threat Intel Report - W37-2022" ], "malware_families": [ "Zloader", "Danabot", "Agent tesla", "Hermes", "Warzone", "Ave maria", "Remote access", "Zeus", "Zeus banking", "Azorult" ], "industries": [ "Military", "Financial", "Banking" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 15, "pulses": [ { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708e8a2deb7fd89b09d554", "name": "IOCs - 20225201339", "description": "", "modified": "2023-12-06T15:08:58.372000", "created": "2023-12-06T15:08:58.372000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1955, "FileHash-SHA256": 839, "FilePath": 1955, "Mutex": 1955, "YARA": 1955, "domain": 179, "URL": 9566, "hostname": 297, "FileHash-SHA1": 4792 }, "indicator_count": 23493, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708dc60765663247bf0c35", "name": "IOCs - 2022511143", "description": "", "modified": "2023-12-06T15:05:41.998000", "created": "2023-12-06T15:05:41.998000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1944, "FileHash-SHA256": 836, "FilePath": 1944, "Mutex": 1944, "YARA": 1944, "URL": 9710, "domain": 172, "hostname": 283, "FileHash-SHA1": 4778 }, "indicator_count": 23555, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707d14ff2377852bad6d80", "name": "Azorult Malware Analysis, Overview by ANY.RUN", "description": "", "modified": "2023-12-06T13:54:28.047000", "created": "2023-12-06T13:54:28.047000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 17, "hostname": 2, "FileHash-SHA256": 21, "FileHash-MD5": 13, "FileHash-SHA1": 12, "URL": 1 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "638dcbd385c4c8b071d944fe", "name": "Threat Intel Report - W50-2022.pdf", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly based recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-01-04T10:01:53.783000", "created": "2022-12-05T10:45:39.829000", "tags": [], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_ Real-time", "https://www.dnsbl.info/", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 101, "CVE": 1, "FileHash-MD5": 10, "FileHash-SHA1": 10, "FileHash-SHA256": 13, "domain": 20, "hostname": 33 }, "indicator_count": 188, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "1242 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6317137bd474b32c0162c595", "name": "Threat Intel Report - W37-2022", "description": "", "modified": "2022-10-06T00:00:46.407000", "created": "2022-09-06T09:31:39.761000", "tags": [], "references": [ "TechM-Threat Intel Report - W37-2022.pdf" ], "public": 1, "adversary": "Threat Intel Report - W37-2022", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 59, "hostname": 58, "URL": 71, "FileHash-MD5": 8, "FileHash-SHA1": 9, "FileHash-SHA256": 14, "CVE": 1 }, "indicator_count": 220, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "1332 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6304f3ff75ddd692ffa71953", "name": "Cyber Threat IOCs_Week35_2022", "description": "Here is a full list of links to the malware that has infected more than 200,000 people in the past two weeks and is being investigated by the UK's National Security Agency (NSA).", "modified": "2022-09-22T00:02:31.511000", "created": "2022-08-23T15:36:31.988000", "tags": [ "hashes domains", "netherlands", "romania", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "paraguay", "algeria", "remcosrat", "mozi", "asyncrat exe", "arechclient2", "redlinestealer", "loader quakbot", "rm3 xlsb", "loader rm3", "netsupport", "irata", "date", "malware url", "tags", "formbook", "neshta", "azorult", "asyncrat" ], "references": [], "public": 1, "adversary": "Cyber Threat IOCs_Week35_2022", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 47, "FileHash-SHA1": 47, "FileHash-SHA256": 109, "domain": 45, "URL": 41, "hostname": 56 }, "indicator_count": 345, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "1346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a7261459933cde712b", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:27.524000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1433 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a874a16678d3b6bef0", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:28.111000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1433 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "genbicta.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "genbicta.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780185264.1492314 }