{ "type": "URL", "indicator": "https://80.76.51.231/Samarik", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://80.76.51.231/Samarik", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4008183849, "indicator": "https://80.76.51.231/Samarik", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 46, "pulses": [ { "id": "67b3182a931f1d22550df883", "name": "Lumma Stealer Chronicles: PDF-themed Campaign Using Compromised Educational Institutions' Infrastructure", "description": "An ongoing malware campaign is distributing Lumma Stealer, an information-stealing malware, through malicious LNK files disguised as PDF documents. The campaign exploits compromised educational institutions' infrastructure to host these files. When executed, the LNK files initiate a multi-stage infection process, ultimately deploying Lumma Stealer on the victim's machine. The malware targets various industries, including education, finance, healthcare, and technology. It employs sophisticated evasion techniques, such as using Steam profiles for command-and-control operations. The campaign highlights the importance of user awareness and robust security measures to protect against this Malware-as-a-Service (MaaS) threat that steals sensitive data like passwords, browser information, and cryptocurrency wallet details.", "modified": "2025-03-19T11:05:48.444000", "created": "2025-02-17T11:06:18.655000", "tags": [ "phishing", "lnk files", "maas", "steam profiles", "multi-stage infection", "information stealing", "lumma stealer", "educational institutions", "pdf-themed" ], "references": [ "https://www.cloudsek.com/blog/lumma-stealer-chronicles-pdf-themed-campaign-using-compromised-educational-institutions-infrastructure" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null } ], "attack_ids": [ { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "display_name": "T1021.002 - SMB/Windows Admin Shares" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036.003", "name": "Rename System Utilities", "display_name": "T1036.003 - Rename System Utilities" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1564.003", "name": "Hidden Window", "display_name": "T1564.003 - Hidden Window" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" } ], "industries": [ "Education", "Finance", "Government", "Healthcare", "Manufacturing", "Technology", "Media" ], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "URL": 2, "domain": 17 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 386580, "modified_text": "438 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6913e168fd82ca941c82ed7f", "name": "InQuest - 11-11-2025", "description": "", "modified": "2025-12-12T01:00:21.615000", "created": "2025-11-12T01:22:48.439000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1627, "modified_text": "170 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69128f3da66a3142f2018f5b", "name": "InQuest - 10-11-2025", "description": "", "modified": "2025-12-11T01:00:08.056000", "created": "2025-11-11T01:19:57.422000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "171 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69113f39a1836c5e9d4dfa75", "name": "InQuest - 09-11-2025", "description": "", "modified": "2025-12-10T01:04:09.054000", "created": "2025-11-10T01:26:17.257000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "172 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690fee42d46e57498499085e", "name": "InQuest - 08-11-2025", "description": "", "modified": "2025-12-09T01:03:09.068000", "created": "2025-11-09T01:28:34.874000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "173 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690e9ed3322f4f24750109ad", "name": "InQuest - 07-11-2025", "description": "", "modified": "2025-12-08T01:03:47.101000", "created": "2025-11-08T01:37:23.724000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690d48e1f96e164faf4d4481", "name": "InQuest - 06-11-2025", "description": "", "modified": "2025-12-07T01:02:10.610000", "created": "2025-11-07T01:18:25.096000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "175 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690bf8f336de410356c9e902", "name": "InQuest - 05-11-2025", "description": "", "modified": "2025-12-06T01:05:09.974000", "created": "2025-11-06T01:25:07.394000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6906b911e31730aaa7497931", "name": "InQuest - 01-11-2025", "description": "", "modified": "2025-12-02T01:05:30.331000", "created": "2025-11-02T01:51:13.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "180 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6905669c366b8c51da7b4fa3", "name": "InQuest - 31-10-2025", "description": "", "modified": "2025-12-01T01:04:29.571000", "created": "2025-11-01T01:47:08.128000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "181 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69040f6c829b6e3f4018a5df", "name": "InQuest - 30-10-2025", "description": "", "modified": "2025-11-30T01:06:08.235000", "created": "2025-10-31T01:22:52.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "182 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6902bd8a4a93702ee86f9e6f", "name": "InQuest - 29-10-2025", "description": "", "modified": "2025-11-29T01:00:13.628000", "created": "2025-10-30T01:21:14.934000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "183 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69016c26e6acc925421729e7", "name": "InQuest - 28-10-2025", "description": "", "modified": "2025-11-28T01:01:19.760000", "created": "2025-10-29T01:21:42.428000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "184 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69001b1f08a8353ff6565cc4", "name": "InQuest - 27-10-2025", "description": "", "modified": "2025-11-27T01:01:22.898000", "created": "2025-10-28T01:23:43.357000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "185 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68fec6a19f06413ffcd28c41", "name": "InQuest - 26-10-2025", "description": "", "modified": "2025-11-26T01:00:30.420000", "created": "2025-10-27T01:10:57.123000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "186 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68fd65dd72b114e463bc1927", "name": "InQuest - 25-10-2025", "description": "", "modified": "2025-11-25T00:03:22.543000", "created": "2025-10-26T00:05:49.395000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "187 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68fc1c1b1e8aab75d27c6ace", "name": "InQuest - 24-10-2025", "description": "", "modified": "2025-11-24T00:03:55.362000", "created": "2025-10-25T00:38:51.397000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "188 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68fac33f72c7237d3680c2a9", "name": "InQuest - 23-10-2025", "description": "", "modified": "2025-11-23T00:04:46.427000", "created": "2025-10-24T00:07:26.392000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "189 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f974e9c52dee6ef1dc4402", "name": "InQuest - 22-10-2025", "description": "", "modified": "2025-11-22T00:01:42.464000", "created": "2025-10-23T00:20:57.351000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "190 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f822c83a9eaa04095f3c34", "name": "InQuest - 21-10-2025", "description": "", "modified": "2025-11-21T00:00:54.614000", "created": "2025-10-22T00:18:16.679000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "191 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f6d1b0dc049d393f39a6c9", "name": "InQuest - 20-10-2025", "description": "", "modified": "2025-11-20T00:02:20.508000", "created": "2025-10-21T00:20:00.737000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "192 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f57e3f6801991ab7bb6064", "name": "InQuest - 19-10-2025", "description": "", "modified": "2025-11-19T00:02:49.008000", "created": "2025-10-20T00:11:43.459000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "193 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f42b8a6d4aa48bfa787786", "name": "InQuest - 18-10-2025", "description": "", "modified": "2025-11-18T00:03:59.309000", "created": "2025-10-19T00:06:34.950000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "194 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f187d2475f95527737f7ec", "name": "InQuest - 16-10-2025", "description": "", "modified": "2025-11-16T00:04:22.390000", "created": "2025-10-17T00:03:30.943000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "196 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68f037b80365dd89d54f8c05", "name": "InQuest - 15-10-2025", "description": "", "modified": "2025-11-15T00:02:40.652000", "created": "2025-10-16T00:09:28.812000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eee5e57599a5c49785be3d", "name": "InQuest - 14-10-2025", "description": "", "modified": "2025-11-14T00:04:17.128000", "created": "2025-10-15T00:08:00.404000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68ed93f252587a171a47e4c5", "name": "InQuest - 13-10-2025", "description": "", "modified": "2025-11-13T00:02:21.655000", "created": "2025-10-14T00:06:10.277000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "199 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68ec43cbc0d87339579fe7c9", "name": "InQuest - 12-10-2025", "description": "", "modified": "2025-11-12T00:05:30.355000", "created": "2025-10-13T00:11:55.937000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "200 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eaf163815769ec957ba8f3", "name": "InQuest - 11-10-2025", "description": "", "modified": "2025-11-11T00:00:14.461000", "created": "2025-10-12T00:08:03.662000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "201 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e9a3399b31eb41103f6f51", "name": "InQuest - 10-10-2025", "description": "", "modified": "2025-11-10T00:05:06.737000", "created": "2025-10-11T00:22:17.558000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "202 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e850618851fd713543d7ab", "name": "InQuest - 09-10-2025", "description": "", "modified": "2025-11-09T00:03:01.593000", "created": "2025-10-10T00:16:33.095000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 98, "URL": 529, "FileHash-SHA1": 47, "FileHash-SHA256": 261, "domain": 115, "FileHash-MD5": 71 }, "indicator_count": 1121, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "203 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e7013824bb244891cdfca2", "name": "InQuest - 08-10-2025", "description": "", "modified": "2025-11-08T00:01:01.095000", "created": "2025-10-09T00:26:32.852000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "204 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e5acdb3bbe2dd71d66813a", "name": "InQuest - 07-10-2025", "description": "", "modified": "2025-11-07T00:02:42.967000", "created": "2025-10-08T00:14:19.336000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 90, "URL": 479, "FileHash-SHA1": 53, "FileHash-SHA256": 229, "domain": 101, "FileHash-MD5": 69 }, "indicator_count": 1021, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "205 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e45b87ebdecbf9ac69e2a7", "name": "InQuest - 06-10-2025", "description": "", "modified": "2025-11-06T00:00:27.507000", "created": "2025-10-07T00:15:03.324000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "206 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e309ab8f26b5c5a1e91462", "name": "InQuest - 05-10-2025", "description": "", "modified": "2025-11-05T00:01:35.296000", "created": "2025-10-06T00:13:31.479000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e1b7832e7490c095c925ff", "name": "InQuest - 04-10-2025", "description": "", "modified": "2025-11-04T00:03:30.889000", "created": "2025-10-05T00:10:43.068000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 123, "URL": 486, "FileHash-SHA256": 325, "FileHash-SHA1": 41, "domain": 107, "FileHash-MD5": 66 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "208 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e06a9390301bf811e48a83", "name": "InQuest - 03-10-2025", "description": "", "modified": "2025-11-03T00:00:29.534000", "created": "2025-10-04T00:30:11.168000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68df13216f406db07fa7a7a3", "name": "InQuest - 02-10-2025", "description": "", "modified": "2025-11-02T00:03:02.474000", "created": "2025-10-03T00:04:49.343000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 526, "domain": 125, "FileHash-SHA1": 49, "FileHash-SHA256": 279, "FileHash-MD5": 70 }, "indicator_count": 1146, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "210 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68ddc1987cc6e92676d40479", "name": "InQuest - 01-10-2025", "description": "", "modified": "2025-11-01T00:02:59.726000", "created": "2025-10-02T00:04:40.205000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "211 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68dc723f00e1f6e1fecc4e6e", "name": "InQuest - 30-09-2025", "description": "", "modified": "2025-10-31T00:03:36.521000", "created": "2025-10-01T00:13:51.581000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "212 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68db1f4319e6109b961ad87c", "name": "InQuest - 29-09-2025", "description": "", "modified": "2025-10-30T00:02:15.510000", "created": "2025-09-30T00:07:31.114000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 113, "URL": 456, "FileHash-SHA1": 41, "FileHash-SHA256": 278, "domain": 100, "FileHash-MD5": 53 }, "indicator_count": 1041, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "213 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d9cd9372fa92abfaabf720", "name": "InQuest - 28-09-2025", "description": "", "modified": "2025-10-29T00:04:41.122000", "created": "2025-09-29T00:06:43.137000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 94, "URL": 524, "domain": 114, "FileHash-SHA1": 47, "FileHash-SHA256": 223, "FileHash-MD5": 71 }, "indicator_count": 1073, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "214 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d87dbb65843acc15935391", "name": "InQuest - 27-09-2025", "description": "", "modified": "2025-10-28T00:00:01.953000", "created": "2025-09-28T00:13:47.657000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "215 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d72cfe0033dd3e7b2ce681", "name": "InQuest - 26-09-2025", "description": "", "modified": "2025-10-27T00:02:55.235000", "created": "2025-09-27T00:17:02.862000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 426, "FileHash-SHA1": 42, "FileHash-SHA256": 262, "domain": 94, "FileHash-MD5": 58 }, "indicator_count": 979, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d5dab4fe48bd21a0a7e19a", "name": "InQuest - 25-09-2025", "description": "", "modified": "2025-10-26T00:00:42.726000", "created": "2025-09-26T00:13:40.945000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 113, "URL": 521, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1055, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "217 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "381 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/", "https://labs.inquest.net/iocdb", "https://www.cloudsek.com/blog/lumma-stealer-chronicles-pdf-themed-campaign-using-compromised-educational-institutions-infrastructure" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Lumma stealer" ], "industries": [ "Manufacturing", "Media", "Technology", "Healthcare", "Government", "Finance", "Education" ], "unique_indicators": 24 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 314848 } } }, "false_positive": [], "alexa": "", "whois": "http://whois.domaintools.com/80.76.51.231", "domain": "Unavailable", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 46, "pulses": [ { "id": "67b3182a931f1d22550df883", "name": "Lumma Stealer Chronicles: PDF-themed Campaign Using Compromised Educational Institutions' Infrastructure", "description": "An ongoing malware campaign is distributing Lumma Stealer, an information-stealing malware, through malicious LNK files disguised as PDF documents. The campaign exploits compromised educational institutions' infrastructure to host these files. When executed, the LNK files initiate a multi-stage infection process, ultimately deploying Lumma Stealer on the victim's machine. The malware targets various industries, including education, finance, healthcare, and technology. It employs sophisticated evasion techniques, such as using Steam profiles for command-and-control operations. The campaign highlights the importance of user awareness and robust security measures to protect against this Malware-as-a-Service (MaaS) threat that steals sensitive data like passwords, browser information, and cryptocurrency wallet details.", "modified": "2025-03-19T11:05:48.444000", "created": "2025-02-17T11:06:18.655000", "tags": [ "phishing", "lnk files", "maas", "steam profiles", "multi-stage infection", "information stealing", "lumma stealer", "educational institutions", "pdf-themed" ], "references": [ "https://www.cloudsek.com/blog/lumma-stealer-chronicles-pdf-themed-campaign-using-compromised-educational-institutions-infrastructure" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null } ], "attack_ids": [ { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "display_name": "T1021.002 - SMB/Windows Admin Shares" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036.003", "name": "Rename System Utilities", "display_name": "T1036.003 - Rename System Utilities" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1564.003", "name": "Hidden Window", "display_name": "T1564.003 - Hidden Window" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" } ], "industries": [ "Education", "Finance", "Government", "Healthcare", "Manufacturing", "Technology", "Media" ], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "URL": 2, "domain": 17 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 386580, "modified_text": "438 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6913e168fd82ca941c82ed7f", "name": "InQuest - 11-11-2025", "description": "", "modified": "2025-12-12T01:00:21.615000", "created": "2025-11-12T01:22:48.439000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1627, "modified_text": "170 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69128f3da66a3142f2018f5b", "name": "InQuest - 10-11-2025", "description": "", "modified": "2025-12-11T01:00:08.056000", "created": "2025-11-11T01:19:57.422000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "171 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69113f39a1836c5e9d4dfa75", "name": "InQuest - 09-11-2025", "description": "", "modified": "2025-12-10T01:04:09.054000", "created": "2025-11-10T01:26:17.257000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "172 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690fee42d46e57498499085e", "name": "InQuest - 08-11-2025", "description": "", "modified": "2025-12-09T01:03:09.068000", "created": "2025-11-09T01:28:34.874000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "173 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690e9ed3322f4f24750109ad", "name": "InQuest - 07-11-2025", "description": "", "modified": "2025-12-08T01:03:47.101000", "created": "2025-11-08T01:37:23.724000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690d48e1f96e164faf4d4481", "name": "InQuest - 06-11-2025", "description": "", "modified": "2025-12-07T01:02:10.610000", "created": "2025-11-07T01:18:25.096000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "175 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690bf8f336de410356c9e902", "name": "InQuest - 05-11-2025", "description": "", "modified": "2025-12-06T01:05:09.974000", "created": "2025-11-06T01:25:07.394000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6906b911e31730aaa7497931", "name": "InQuest - 01-11-2025", "description": "", "modified": "2025-12-02T01:05:30.331000", "created": "2025-11-02T01:51:13.004000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "180 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6905669c366b8c51da7b4fa3", "name": "InQuest - 31-10-2025", "description": "", "modified": "2025-12-01T01:04:29.571000", "created": "2025-11-01T01:47:08.128000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 114, "URL": 532, "FileHash-SHA256": 216, "hostname": 87, "FileHash-MD5": 72, "FileHash-SHA1": 46 }, "indicator_count": 1067, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "181 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://80.76.51.231/Samarik", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://80.76.51.231/Samarik", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "hta", "IDATDropper", "LummaStealer", "ua-wget" ], "date_added": "2024-11-28", "last_online": "2025-02-12", "reporter": "DaveLikesMalwre", "host": "80.76.51.231", "payloads": [ { "filename": "Samarik", "file_type": "exe", "md5": "e8c68f1ef3006a3e728a61893e21c13c", "sha256": "40b80287ba2af16daaf8e74a9465a0b876ab39f68c7ba6405cfcb41601eeec15", "signature": "LummaStealer", "first_seen": "2024-11-28" } ], "error": null }, "from_cache": true, "_cached_at": 1780262102.4803805 }