{ "type": "URL", "indicator": "https://hbogo.cz/activate", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://hbogo.cz/activate", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3650043976, "indicator": "https://hbogo.cz/activate", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "69c1bd40f81db45dc044697c", "name": "Masterkey Clone By CallmeDoris", "description": "", "modified": "2026-03-23T22:22:56.940000", "created": "2026-03-23T22:22:56.940000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "642db7b656049e54b2f71c20", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099064c0c0aa442282397", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-12-06T15:53:42.077000", "created": "2023-12-06T15:53:42.077000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1040, "domain": 293, "FileHash-MD5": 58, "FileHash-SHA1": 56, "hostname": 809, "URL": 2661, "email": 1 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098ff4c59f8ac3f86f613", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "", "modified": "2023-12-06T15:53:35.032000", "created": "2023-12-06T15:53:35.032000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1168, "hostname": 1366, "domain": 412, "URL": 3576, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098f7a0c84c2c55585e87", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "", "modified": "2023-12-06T15:53:27.118000", "created": "2023-12-06T15:53:27.118000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 279, "FileHash-SHA256": 1027, "hostname": 933, "URL": 2201, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098f2c33d291538754bc7", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "", "modified": "2023-12-06T15:53:22.011000", "created": "2023-12-06T15:53:22.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 279, "FileHash-SHA256": 1027, "hostname": 933, "URL": 2201, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642eac06b2963a871b0fdd45", "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection", "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m", "modified": "2023-05-06T10:00:48.707000", "created": "2023-04-06T11:24:54.313000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "span", "optout", "pcap processing", "pattern match", "script", "click", "date", "middle", "null", "april", "twitter", "body", "error", "jackson", "desktop", "service", "bill", "heat", "webview", "cruise", "blank", "meta", "night", "false", "contact", "suspicious", "facebook", "close", "cannon", "mayberry", "santana", "comment", "flex", "karma", "nightmare", "find", "spacer", "kitty", "mike", "local", "already", "soldier", "wallpaper", "story", "generic", "tiny", "trident", "android", "hybrid", "general", "hosts", "favorite", "homepage", "music", "code", "push", "strings", "malicious", "qakbot", "25px", "60px", "24px", "100px", "1439px", "segoe ui", "roboto", "path", "chat", "form", "embed", "unknown", "live", "network", "unicode", "feed", "5000", "next", "fullscreen", "iframe", "latv", "latino voices", "localappdata", "latino", "noscript", "pragma", "this", "hybrid analysis", "programfiles", "input", "wilstaging02", "potential ip" ], "references": [ "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1291, "email": 13, "domain": 591, "URL": 3931, "FileHash-SHA256": 431, "FileHash-MD5": 92, "FileHash-SHA1": 89 }, "indicator_count": 6438, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "1080 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642db7b656049e54b2f71c20", "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100", "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness", "modified": "2023-05-05T16:00:23.366000", "created": "2023-04-05T18:02:30.403000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1081 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642d4c321a389c0385920349", "name": ";https://webmail.shahroodut.ac.ir/ajax/redir.hsp?url=https%3A%2F%2Fees.elsevier.com%2Fnpb'", "description": "", "modified": "2023-05-04T23:04:14.165000", "created": "2023-04-05T10:23:46.725000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "runtime data", "optout", "ansi", "dropped file", "drmedgeua", "unicode", "optin", "edgeua", "hidemfhevccodec", "close", "error", "roboto", "hybrid", "suspicious", "click", "hosts", "april", "general", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 144, "hostname": 75, "domain": 52, "FileHash-MD5": 57, "FileHash-SHA1": 47, "FileHash-SHA256": 49 }, "indicator_count": 424, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1081 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642c3e46df286e02b6685576", "name": "http://mat8a.xyz/ - IRAN", "description": "", "modified": "2023-05-04T14:02:11.229000", "created": "2023-04-04T15:12:06.538000", "tags": [ "malware", "trojan", "dropped file", "ansi", "chromeua", "optout", "runtime data", "object", "drmedgeua", "edgeua", "optin", "unicode", "error", "generator", "span", "win64", "void", "entropy", "date", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "cookie", "cray", "smwg", "legend", "eret", "nuke", "lion", "ahav", "core", "malicious", "mozilla", "strings", "qakbot", "javascript", "http://mat8a.xyz/" ], "references": [ "http://mat8a.xyz/", "https://hybrid-analysis.com/sample/aae2d9c3cce607a9fef69337ac7924d67daa2eef5a385540445636a4e6f89bc3/6426fb0cd69b3b6b7e02b588" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2512, "hostname": 835, "domain": 233, "FileHash-SHA256": 118, "FileHash-MD5": 60, "FileHash-SHA1": 54, "email": 2 }, "indicator_count": 3814, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1082 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6428649b535c12c6f8d60b0b", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-05-01T15:05:10.466000", "created": "2023-04-01T17:06:35.022000", "tags": [ "chromeua", "ansi", "dropped file", "optout", "runtime data", "object", "drmedgeua", "optin", "edgeua", "unicode", "span", "error", "generator", "void", "path", "null", "entropy", "click", "template", "date", "unknown", "critical", "addressbar", "desktop", "dark", "light", "quicksearch", "this", "suspicious", "window", "legend", "hybrid", "hosts", "next", "main", "refresh", "hello", "voice", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/45e147babe00d1834af72b2139dbc65043ee50cb09d1d4e470f9bd48ad50c6bf/64283fca3a07828f100b2551" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2661, "hostname": 809, "domain": 293, "FileHash-SHA256": 1040, "email": 1, "FileHash-MD5": 58, "FileHash-SHA1": 56 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1085 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6425a2f9c155fd53b9922bcd", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "hope peeps are gona learn from 3cx that false positives are in fact often not false", "modified": "2023-04-29T13:05:05.409000", "created": "2023-03-30T14:55:53.652000", "tags": [ "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "optout", "programfiles", "typeof e", "localappdata", "error", "date", "generator", "path", "null", "void", "win64", "twitter", "this", "critical", "desktop", "dark", "light", "meta", "roboto", "span", "class", "template", "blink", "suspicious", "facebook", "mexico", "malicious", "mozilla", "strings", "qakbot", "://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00" ], "references": [ "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661", "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 412, "FileHash-SHA256": 1168, "URL": 3576, "hostname": 1366, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1087 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "641e0e3da4fbafac633c0124", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "email confirmation link sent for blockchain wallet on iphone", "modified": "2023-04-23T19:00:53.967000", "created": "2023-03-24T20:55:25.579000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "dropped file", "ansi", "optout", "license", "runtime data", "drmedgeua", "localappdata", "edgeua", "optin", "error", "span", "template", "unknown", "class", "window", "legend", "mexico", "hybrid", "suspicious", "general", "malicious", "close", "click", "date", "hosts", "express", "strings", "format", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e", "Full URL from email", "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2201, "hostname": 933, "domain": 279, "FileHash-SHA256": 1027, "email": 2, "FileHash-MD5": 56, "FileHash-SHA1": 51 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1093 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "641e0e41b1efe6e622d75902", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "email confirmation link sent for blockchain wallet on iphone", "modified": "2023-04-23T19:00:53.967000", "created": "2023-03-24T20:55:29.514000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "dropped file", "ansi", "optout", "license", "runtime data", "drmedgeua", "localappdata", "edgeua", "optin", "error", "span", "template", "unknown", "class", "window", "legend", "mexico", "hybrid", "suspicious", "general", "malicious", "close", "click", "date", "hosts", "express", "strings", "format", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e", "Full URL from email", "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2201, "hostname": 933, "domain": 279, "FileHash-SHA256": 1027, "email": 2, "FileHash-MD5": 56, "FileHash-SHA1": 51 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1093 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://hybrid-analysis.com/sample/45e147babe00d1834af72b2139dbc65043ee50cb09d1d4e470f9bd48ad50c6bf/64283fca3a07828f100b2551", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9", "Full URL from email", "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661", "http://mat8a.xyz/", "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b", "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e", "https://hybrid-analysis.com/sample/aae2d9c3cce607a9fef69337ac7924d67daa2eef5a385540445636a4e6f89bc3/6426fb0cd69b3b6b7e02b588", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 20139 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/hbogo.cz", "whois": "http://whois.domaintools.com/hbogo.cz", "domain": "hbogo.cz", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "69c1bd40f81db45dc044697c", "name": "Masterkey Clone By CallmeDoris", "description": "", "modified": "2026-03-23T22:22:56.940000", "created": "2026-03-23T22:22:56.940000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "642db7b656049e54b2f71c20", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099064c0c0aa442282397", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-12-06T15:53:42.077000", "created": "2023-12-06T15:53:42.077000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1040, "domain": 293, "FileHash-MD5": 58, "FileHash-SHA1": 56, "hostname": 809, "URL": 2661, "email": 1 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098ff4c59f8ac3f86f613", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "", "modified": "2023-12-06T15:53:35.032000", "created": "2023-12-06T15:53:35.032000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1168, "hostname": 1366, "domain": 412, "URL": 3576, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098f7a0c84c2c55585e87", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "", "modified": "2023-12-06T15:53:27.118000", "created": "2023-12-06T15:53:27.118000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 279, "FileHash-SHA256": 1027, "hostname": 933, "URL": 2201, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098f2c33d291538754bc7", "name": "https://login.blockchain.com/?#%2Fverify-email ->", "description": "", "modified": "2023-12-06T15:53:22.011000", "created": "2023-12-06T15:53:22.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 279, "FileHash-SHA256": 1027, "hostname": 933, "URL": 2201, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 4549, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642eac06b2963a871b0fdd45", "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection", "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m", "modified": "2023-05-06T10:00:48.707000", "created": "2023-04-06T11:24:54.313000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "span", "optout", "pcap processing", "pattern match", "script", "click", "date", "middle", "null", "april", "twitter", "body", "error", "jackson", "desktop", "service", "bill", "heat", "webview", "cruise", "blank", "meta", "night", "false", "contact", "suspicious", "facebook", "close", "cannon", "mayberry", "santana", "comment", "flex", "karma", "nightmare", "find", "spacer", "kitty", "mike", "local", "already", "soldier", "wallpaper", "story", "generic", "tiny", "trident", "android", "hybrid", "general", "hosts", "favorite", "homepage", "music", "code", "push", "strings", "malicious", "qakbot", "25px", "60px", "24px", "100px", "1439px", "segoe ui", "roboto", "path", "chat", "form", "embed", "unknown", "live", "network", "unicode", "feed", "5000", "next", "fullscreen", "iframe", "latv", "latino voices", "localappdata", "latino", "noscript", "pragma", "this", "hybrid analysis", "programfiles", "input", "wilstaging02", "potential ip" ], "references": [ "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1291, "email": 13, "domain": 591, "URL": 3931, "FileHash-SHA256": 431, "FileHash-MD5": 92, "FileHash-SHA1": 89 }, "indicator_count": 6438, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "1080 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642db7b656049e54b2f71c20", "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100", "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness", "modified": "2023-05-05T16:00:23.366000", "created": "2023-04-05T18:02:30.403000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1081 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642d4c321a389c0385920349", "name": ";https://webmail.shahroodut.ac.ir/ajax/redir.hsp?url=https%3A%2F%2Fees.elsevier.com%2Fnpb'", "description": "", "modified": "2023-05-04T23:04:14.165000", "created": "2023-04-05T10:23:46.725000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "runtime data", "optout", "ansi", "dropped file", "drmedgeua", "unicode", "optin", "edgeua", "hidemfhevccodec", "close", "error", "roboto", "hybrid", "suspicious", "click", "hosts", "april", "general", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 144, "hostname": 75, "domain": 52, "FileHash-MD5": 57, "FileHash-SHA1": 47, "FileHash-SHA256": 49 }, "indicator_count": 424, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1081 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642c3e46df286e02b6685576", "name": "http://mat8a.xyz/ - IRAN", "description": "", "modified": "2023-05-04T14:02:11.229000", "created": "2023-04-04T15:12:06.538000", "tags": [ "malware", "trojan", "dropped file", "ansi", "chromeua", "optout", "runtime data", "object", "drmedgeua", "edgeua", "optin", "unicode", "error", "generator", "span", "win64", "void", "entropy", "date", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "cookie", "cray", "smwg", "legend", "eret", "nuke", "lion", "ahav", "core", "malicious", "mozilla", "strings", "qakbot", "javascript", "http://mat8a.xyz/" ], "references": [ "http://mat8a.xyz/", "https://hybrid-analysis.com/sample/aae2d9c3cce607a9fef69337ac7924d67daa2eef5a385540445636a4e6f89bc3/6426fb0cd69b3b6b7e02b588" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2512, "hostname": 835, "domain": 233, "FileHash-SHA256": 118, "FileHash-MD5": 60, "FileHash-SHA1": 54, "email": 2 }, "indicator_count": 3814, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1082 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6428649b535c12c6f8d60b0b", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-05-01T15:05:10.466000", "created": "2023-04-01T17:06:35.022000", "tags": [ "chromeua", "ansi", "dropped file", "optout", "runtime data", "object", "drmedgeua", "optin", "edgeua", "unicode", "span", "error", "generator", "void", "path", "null", "entropy", "click", "template", "date", "unknown", "critical", "addressbar", "desktop", "dark", "light", "quicksearch", "this", "suspicious", "window", "legend", "hybrid", "hosts", "next", "main", "refresh", "hello", "voice", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/45e147babe00d1834af72b2139dbc65043ee50cb09d1d4e470f9bd48ad50c6bf/64283fca3a07828f100b2551" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2661, "hostname": 809, "domain": 293, "FileHash-SHA256": 1040, "email": 1, "FileHash-MD5": 58, "FileHash-SHA1": 56 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1085 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://hbogo.cz/activate", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://hbogo.cz/activate", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776724174.225184 }