{ "type": "URL", "indicator": "https://alayyadcare.com/tmp/index.php", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://alayyadcare.com/tmp/index.php", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3756265542, "indicator": "https://alayyadcare.com/tmp/index.php", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "650a2f3c0ae4d4988bf630e8", "name": "URLHaus data - 19-09-2023", "description": "", "modified": "2023-10-19T23:00:47.834000", "created": "2023-09-19T23:31:08.046000", "tags": [ "hajime", "Mozi", "elf", "mirai", "AgentTesla", "exe", "njRAT", "32-bit", "mips", "android", "apk", "IRATA", "APT", "ascii", "DUCKTAIL", "powershell", "ps1", "Encoded", "GuLoader", "encrypted", "dropped-by-PrivateLoader", "Formbook", "opendir", "PurpleFox", "bitrat", "rat", "RemcosRAT", "discord", "pwd-drtherapybeta", "RedLine", "RedLineStealer", "djvu", "Vidar", "impersonation", "phishing", "dropped-by-SmokeLoader", "ecf2a6a992825b3d7006296b443d6b3c", "arm", "32", "PrivateLoader", "povertystealer", "Smoke Loader", "smokeloader", "Stealc", "script", "VoidRAT", "wshrat", "AveMariaRAT", "warzone", "sparc", "Phobos", "SystemBC", "MarsStealer", "CoinMiner", "Gozi", "ISFB", "ursnif", "dll", "RecordBreaker", "NanoCore", "hta", "vbs", "dcrat", "stealer", "Amadey", "glupteba", "xmrig", "trojan", "64", "PowerPC", "motorola" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 83, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 170, "domain": 12, "hostname": 7 }, "indicator_count": 189, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "955 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "5ec2ef266cb05ec0dbd3d30e", "name": "Abuse.ch URLhaus Recent", "description": "", "modified": "2023-10-18T21:45:23.616000", "created": "2020-05-18T20:25:10.333000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 639, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "threatmanager", "id": "74623", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1182 }, "indicator_count": 1182, "is_author": false, "is_subscribing": null, "subscriber_count": 612, "modified_text": "956 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 1435 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/alayyadcare.com", "whois": "http://whois.domaintools.com/alayyadcare.com", "domain": "alayyadcare.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "650a2f3c0ae4d4988bf630e8", "name": "URLHaus data - 19-09-2023", "description": "", "modified": "2023-10-19T23:00:47.834000", "created": "2023-09-19T23:31:08.046000", "tags": [ "hajime", "Mozi", "elf", "mirai", "AgentTesla", "exe", "njRAT", "32-bit", "mips", "android", "apk", "IRATA", "APT", "ascii", "DUCKTAIL", "powershell", "ps1", "Encoded", "GuLoader", "encrypted", "dropped-by-PrivateLoader", "Formbook", "opendir", "PurpleFox", "bitrat", "rat", "RemcosRAT", "discord", "pwd-drtherapybeta", "RedLine", "RedLineStealer", "djvu", "Vidar", "impersonation", "phishing", "dropped-by-SmokeLoader", "ecf2a6a992825b3d7006296b443d6b3c", "arm", "32", "PrivateLoader", "povertystealer", "Smoke Loader", "smokeloader", "Stealc", "script", "VoidRAT", "wshrat", "AveMariaRAT", "warzone", "sparc", "Phobos", "SystemBC", "MarsStealer", "CoinMiner", "Gozi", "ISFB", "ursnif", "dll", "RecordBreaker", "NanoCore", "hta", "vbs", "dcrat", "stealer", "Amadey", "glupteba", "xmrig", "trojan", "64", "PowerPC", "motorola" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 83, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 170, "domain": 12, "hostname": 7 }, "indicator_count": 189, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "955 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "5ec2ef266cb05ec0dbd3d30e", "name": "Abuse.ch URLhaus Recent", "description": "", "modified": "2023-10-18T21:45:23.616000", "created": "2020-05-18T20:25:10.333000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 639, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "threatmanager", "id": "74623", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1182 }, "indicator_count": 1182, "is_author": false, "is_subscribing": null, "subscriber_count": 612, "modified_text": "956 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://alayyadcare.com/tmp/index.php", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://alayyadcare.com/tmp/index.php", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "cutwail", "dropped-by-SmokeLoader", "LummaStealer", "MysticStealer", "RecordBreaker", "RedLineStealer", "Smoke Loader", "Stealc", "Tofsee", "UACModuleSmokeLoader" ], "date_added": "2023-09-19", "last_online": "2023-11-20", "reporter": "Casperinous", "host": "alayyadcare.com", "payloads": [ { "filename": "83d1bc81.exe", "file_type": "exe", "md5": "77bb1873af0ec7a5e463eb17638256f0", "sha256": "2702190e3ad0a34a32827575f2a87d6729d3fa5780617a9238e621e6fddda74a", "signature": "Smoke Loader", "first_seen": "2023-11-20" }, { "filename": "19510dcc.exe", "file_type": "exe", "md5": "540c9d6fa1afabfbbbfb3a664574285a", "sha256": "f63cf6caedf428008a1717c0b9e40d3b8987c6f7197ce065159537425ddfbc94", "signature": "Smoke Loader", "first_seen": "2023-11-20" }, { "filename": "1d18a452.exe", "file_type": "exe", "md5": "fc8ca7f700af505cf839a3089918c3c8", "sha256": "e48e146b2b0b3942b3a097b393f9ac599d63097f8a199c6d819dfc18596cc6aa", "signature": "Smoke Loader", "first_seen": "2023-11-20" }, { "filename": "f79b0851.exe", "file_type": "exe", "md5": "06bb71ad00cf3ed6f68ee0ff285fe351", "sha256": "839c39cefe61e0bab9e0da6aaff2ae95aa93b6b8ef947bf712dbc75482f3a4af", "signature": "Smoke Loader", "first_seen": "2023-11-19" }, { "filename": "dbcf667d.exe", "file_type": "exe", "md5": "5f56c1a75c2f891bae6da8351ac33cef", "sha256": "85df9189109abf7fa3cf3e8dcb7cb50a520bbcbdc78d829d3ac36fd11a13d27e", "signature": "Smoke Loader", "first_seen": "2023-11-19" } ], "error": null }, "from_cache": true, "_cached_at": 1780345556.114772 }