{ "type": "URL", "indicator": "https://cleanmymac.pro/files/CleanMyMac-App.dmg", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://cleanmymac.pro/files/CleanMyMac-App.dmg", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3833111373, "indicator": "https://cleanmymac.pro/files/CleanMyMac-App.dmg", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "67ba23df36f4918e7c374158", "name": "GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure", "description": "", "modified": "2025-03-24T19:03:26.922000", "created": "2025-02-22T19:22:07.306000", "tags": [], "references": [ "https://go.recordedfuture.com/hubfs/reports/cta-2024-0514.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1587", "name": "Develop Capabilities", "display_name": "T1587 - Develop Capabilities" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1592", "name": "Gather Victim Host Information", "display_name": "T1592 - Gather Victim Host Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Armature_TIP", "id": "308911", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_308911/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 29, "FileHash-SHA1": 25, "FileHash-SHA256": 31, "URL": 5, "domain": 31, "hostname": 3 }, "indicator_count": 124, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "436 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "670a762b348f01dd15851287", "name": "URLhaus Country Feed (Iran)", "description": "", "modified": "2024-11-11T13:00:21.858000", "created": "2024-10-12T13:14:19.908000", "tags": [], "references": [ "https://urlhaus.abuse.ch/feeds/country/IR/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 6641, "domain": 1596, "hostname": 170 }, "indicator_count": 8411, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65bae24dfa7ad8fcc3131700", "name": "URLHaus data - 31-01-2024", "description": "", "modified": "2024-03-02T00:00:05.957000", "created": "2024-02-01T00:14:05.961000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "dropped-by-SmokeLoader", "arm", "mirai", "npm", "rat", "discord", "infostealer", "pwd-beta_EKhZFa", "discordrat", "js", "hajime", "LummaStealer", "dropped-by-PrivateLoader", "chatnoir", "epsilon", "malware", "exe", "dcrat", "DarkGate", "script", "ascii", "AgentTesla", "Encoded", "powershell", "ps1", "RemcosRAT", "GuLoader", "doc", "vbs", "gafgyt", "emailteamsecurity.xyz", "mcafee", "Vidar", "BlendyBeta", "BlendyGame", "Password-protected", "pw-beta", "1234", "rar", "Amos", "macOS", "stealer", "dropped-by-guloader", "aggah", "hagga", "WSOWebShell", "cutwail", "RedLineStealer", "encrypted", "opendir", "Amadey", "32", "GlobalNet", "python", "LgoogLoader", "remcos", "zgRAT", "cloak", "ransomwaregroup", "Base64-encoded", "DBatLoader", "64", "PowerPC", "intel", "motorola", "bashlite", "renesas", "Formbook", "fabookie" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 612, "hostname": 14, "domain": 19 }, "indicator_count": 645, "is_author": false, "is_subscribing": null, "subscriber_count": 1626, "modified_text": "823 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/feeds/country/IR/", "https://urlhaus.abuse.ch/browse/", "https://go.recordedfuture.com/hubfs/reports/cta-2024-0514.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 11830 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/cleanmymac.pro", "whois": "http://whois.domaintools.com/cleanmymac.pro", "domain": "cleanmymac.pro", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "67ba23df36f4918e7c374158", "name": "GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure", "description": "", "modified": "2025-03-24T19:03:26.922000", "created": "2025-02-22T19:22:07.306000", "tags": [], "references": [ "https://go.recordedfuture.com/hubfs/reports/cta-2024-0514.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1587", "name": "Develop Capabilities", "display_name": "T1587 - Develop Capabilities" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1592", "name": "Gather Victim Host Information", "display_name": "T1592 - Gather Victim Host Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Armature_TIP", "id": "308911", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_308911/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 29, "FileHash-SHA1": 25, "FileHash-SHA256": 31, "URL": 5, "domain": 31, "hostname": 3 }, "indicator_count": 124, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "436 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "670a762b348f01dd15851287", "name": "URLhaus Country Feed (Iran)", "description": "", "modified": "2024-11-11T13:00:21.858000", "created": "2024-10-12T13:14:19.908000", "tags": [], "references": [ "https://urlhaus.abuse.ch/feeds/country/IR/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 6641, "domain": 1596, "hostname": 170 }, "indicator_count": 8411, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65bae24dfa7ad8fcc3131700", "name": "URLHaus data - 31-01-2024", "description": "", "modified": "2024-03-02T00:00:05.957000", "created": "2024-02-01T00:14:05.961000", "tags": [ "32-bit", "elf", "mips", "Mozi", "SocGholish", "dropped-by-SmokeLoader", "arm", "mirai", "npm", "rat", "discord", "infostealer", "pwd-beta_EKhZFa", "discordrat", "js", "hajime", "LummaStealer", "dropped-by-PrivateLoader", "chatnoir", "epsilon", "malware", "exe", "dcrat", "DarkGate", "script", "ascii", "AgentTesla", "Encoded", "powershell", "ps1", "RemcosRAT", "GuLoader", "doc", "vbs", "gafgyt", "emailteamsecurity.xyz", "mcafee", "Vidar", "BlendyBeta", "BlendyGame", "Password-protected", "pw-beta", "1234", "rar", "Amos", "macOS", "stealer", "dropped-by-guloader", "aggah", "hagga", "WSOWebShell", "cutwail", "RedLineStealer", "encrypted", "opendir", "Amadey", "32", "GlobalNet", "python", "LgoogLoader", "remcos", "zgRAT", "cloak", "ransomwaregroup", "Base64-encoded", "DBatLoader", "64", "PowerPC", "intel", "motorola", "bashlite", "renesas", "Formbook", "fabookie" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 612, "hostname": 14, "domain": 19 }, "indicator_count": 645, "is_author": false, "is_subscribing": null, "subscriber_count": 1626, "modified_text": "823 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://cleanmymac.pro/files/CleanMyMac-App.dmg", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://cleanmymac.pro/files/CleanMyMac-App.dmg", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "Amos", "macOS", "stealer" ], "date_added": "2024-01-31", "last_online": "2024-01-31", "reporter": "fbone3", "host": "cleanmymac.pro", "payloads": [ { "filename": null, "file_type": "unknown", "md5": "d501c1cd48dc30a5b8b47b3b7a557f55", "sha256": "a4d7014a4d8dbce95960d44be9931273d1a76bf1132597c20bcbacf25697f2b9", "signature": null, "first_seen": "2024-01-31" } ], "error": null }, "from_cache": true, "_cached_at": 1780529869.4590957 }