{ "type": "URL", "indicator": "https://home.mountainbox.fr", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://home.mountainbox.fr", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3880122109, "indicator": "https://home.mountainbox.fr", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 19, "pulses": [ { "id": "69c0a0e53959e34f9b4b2318", "name": "3 - Eksplorator Windows.lnk 2b7827fa8f8b2e19a10da8c5b0c744d06 clone by Arek-BTC", "description": "", "modified": "2026-03-23T02:09:41.649000", "created": "2026-03-23T02:09:41.649000", "tags": [ "name microsoft", "valid from", "valid", "valid usage", "serial number", "authority", "thumbprint", "status valid", "all algorithm", "timestamp pca", "date", "access date", "command line", "image20073", "windows", "produkty", "pyta dvd", "pro asus", "hashdb narodowa", "oprogramowania", "nsrl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "677076d5a3d1a5495804ee58", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 65, "FileHash-SHA256": 342, "hostname": 1, "URL": 3 }, "indicator_count": 488, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "70 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6761c6d68582c49eff306fe6", "name": "Likely malicious Google Analytics Alternative - App & Web Analytics - Matomo", "description": "The full text of the \"suspicious\"obfuscation using unescape has been published on the website tylabs.com, as well as the official release of a new version of PDF.", "modified": "2025-05-14T21:24:25.364000", "created": "2024-12-17T18:45:42.250000", "tags": [ "bitcoin address", "didier stevens", "didierstevens", "bitcoinaddress", "june", "copyright", "t1027", "unesc", "unescape", "flash define", "matomo", "string", "date", "sufeffxa0", "regexp", "please", "blob", "null", "tag manager", "link", "url https", "ipv4", "url http", "learn", "it for", "no credit", "cloud trial", "start", "contact", "matomo team", "help", "free", "easy", "tools" ], "references": [ "https://matomo.org https://matomo.www.gov.pl/analytics/js/container_68lYTZ79.js", "https://www.filescan.io/uploads/67619a0f99caec9a276f9efd/reports/92e63ab1-1ebd-41a7-90da-f842f0b90392/details" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 62, "YARA": 8, "domain": 83, "URL": 657, "email": 3, "hostname": 152, "IPv4": 15, "CIDR": 1, "FileHash-SHA1": 57, "FileHash-SHA256": 734 }, "indicator_count": 1772, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676b5a7cd903a3fec3a68ba7", "name": "fec126b5fc67fefdf27ad52ae8c829836f47d29eef6eea8f77c86c996969a9da - Overview", "description": "We use cookies to store information on our website, but we do not store any personally identifiable data, so we may use them to monitor how we interact with your browser and send messages to our users.", "modified": "2025-05-14T21:23:57.367000", "created": "2024-12-25T01:06:04.499000", "tags": [ "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "nothreat osint", "znaleziono cz", "werdykt brak", "duration", "analytics", "reject all", "cookie ga", "file details", "url details", "rules extracted", "alexa" ], "references": [ "fec126b5fc67fefdf27ad52ae8c829836f47d29eef6eea8f77c86c996969a9da - Overview.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 70, "FileHash-SHA256": 88, "domain": 8, "hostname": 16 }, "indicator_count": 182, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6761b182afcf75c534592978", "name": "https://www.gov.pl/web/po-jelenia-gora/ 1d377a4d5113569a68325ac055eeadfc1cbda39a0f299820f15be09342a575c7", "description": "Hasze - zidentyfikowano 43-year-old Hasze, also known as Gariad, is on offer for \u00a31.5m in donations from the European Union.", "modified": "2025-05-14T21:14:42.256000", "created": "2024-12-17T17:14:42.127000", "tags": [ "nazwa", "b3rze", "refts0", "hasze", "adresy url", "nazwa https", "id76c1f", "idn1", "sendimage0", "idn0" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 127, "domain": 4, "URL": 74, "hostname": 3, "FileHash-MD5": 28, "FileHash-SHA1": 28, "email": 1 }, "indicator_count": 265, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67709b347e368914cb5d1fa2", "name": "ld869rwRuHeO9Tw.exe 1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada", "description": "https://www.hybrid-analysis.com/sample/1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada/677086f7a2798798250fafcd\nLastcode analysis wedi cyhoeddi i'wadu cyffredinol, \u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m.", "modified": "2025-05-14T21:11:16.436000", "created": "2024-12-29T00:43:32.094000", "tags": [ "sha256 file", "type type", "language chi2", "image english", "us 1", "1 upx1", "monitoruj", "rozszerzenia", "kali linux", "live boot", "apple m1", "kolekcja dvd", "sound pool", "hashdb narodowa", "oprogramowania", "nsrl", "programfiles", "kopiuj md5", "kopiuj sha1", "skopiuj sha256", "sha1", "sha256", "runtime process", "description zip", "type", "size", "error", "null", "install", "bitcoin", "python", "calendar", "xorist", "path", "refresh", "body", "span", "green", "win32", "designer", "filler", "tools", "black", "wallpaper", "zapis", "pulpit", "autoit", "bill", "light", "stars", "look", "verify", "restart", "desktop" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 491, "FileHash-MD5": 452, "FileHash-SHA1": 458, "BitcoinAddress": 1, "URL": 39, "domain": 66, "hostname": 18 }, "indicator_count": 1525, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676ecc52456eb31564512705", "name": "jusched.exe UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar i John Reiser", "description": "192.168.0.194 23.253.126.58 HTTP 106 GET /post/echo HTTP/1.1\nWersja pliku: 6.0.100.33\nMaszyna docelowa: Procesory Intel 386 lub nowsze oraz zgodne procesory\nPunkt wej\u015bcia: 0x00076A70\nLiczba sekcji: 3\nA security alert issued by the European Commission has identified a malicious process masquerading as the legitimate \"svchost.exe\" operating system and executing from an uncommon location in an unknown location.", "modified": "2025-05-14T20:50:19.966000", "created": "2024-12-27T15:48:34.024000", "tags": [ "sha256", "java", "win32 exe", "intel", "utc first", "submission", "file version", "platform se", "contained", "vhash", "ssdeep", "crypter", "poudel date", "nextron", "lazarus group", "system file", "anomaly id", "svchost rule", "windows system", "roth", "patrick bareiss", "anton kutepov", "winreagent", "vitali kremez", "wykryto scraper", "jackpos", "sopsop", "security" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 18, "FileHash-SHA1": 14, "FileHash-SHA256": 91, "domain": 30, "URL": 190, "hostname": 65, "CVE": 2 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6776887cdd7b2fd90f7fdb63", "name": "http://2.16.6.6/ MD5-8c69ea7049dbdf22081e78945d63cb76 2ad2ad0002ad2ad08c2ad2ad2ad2ada14926db9b7be3a1010242195721efd9", "description": "https://aplikacja.ceidg.gov.pl/?Id=7a025cc6-5167-43cf-947f-387a3b830778\nhttps://aplikacja.ceidg.gov.pl/favicon.ico\n2.16.6.6\nhttp://2.16.6.6/\nhttps://2.16.6.6/\nOdcisk palca JARM\n2ad2ad0002ad2ad08c2ad2ad2ad2ada14926db9b7be3a1010242195721efd9", "modified": "2025-02-09T04:44:15.872000", "created": "2025-01-02T12:37:16.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 1, "URL": 836, "domain": 20, "hostname": 257, "FileHash-SHA256": 66, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1182, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "477 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67768113826cf5a2959c0c97", "name": "ghn2.16.6.6 hjjgh", "description": "", "modified": "2025-02-09T04:44:15.025000", "created": "2025-01-02T12:05:39.474000", "tags": [ "configoverride", "continuity", "pageparams", "iframedelay", "autoxhr", "history", "angular", "backbone", "ember", "crossdomain" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 4, "URL": 26, "hostname": 2, "domain": 2, "FileHash-SHA256": 25 }, "indicator_count": 59, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "477 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "677de70273499f868768ca1f", "name": "pwacka.com strona g\u0142\u00f3wna.mountainbox.fr", "description": "aplikacja/plik wykonywalny x\nhttp://159.65.59.62/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl", "modified": "2025-02-07T02:01:54.054000", "created": "2025-01-08T02:46:26.023000", "tags": [ "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "msdos", "ms windows", "pe32", "intel", "plik", "instrukcja", "tekst w", "utf16 unicode", "z terminatorami", "crlf", "rodzestwo", "win32", "vitro", "tekst", "https ostatni", "https dane", "v3 numer", "odcisk palca", "wystawca", "gb st", "greater", "manchester cn", "sectigo", "meneder proxy", "identyfikator", "dane", "nginx wano", "nie wczeniej", "nie po", "algorytm", "rsa klucz", "binchmod", "awinwkqonp", "usrbincurl o", "mips", "mipsi wersja", "sysv", "nazwa typ", "md5 nazwa", "gnulinux", "elf binary", "upx compression", "roth", "nextron", "info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1058, "FileHash-MD5": 161, "FileHash-SHA1": 118, "domain": 132, "hostname": 116, "URL": 253, "email": 5, "YARA": 1 }, "indicator_count": 1844, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "479 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6776742b3dc3a0e46cc14a9a", "name": "Chrome Cache Entry: 843 MD5-16cba75f4b9969077ff30bea2f494e12, sha256-241ced7f220982f5679a64cc6db34ed42cd21274508cc5814616d9efe374afde", "description": "Matched URL\tScan:\nhttps://www.adorno.pl/\nhttps://www.portugalvineyards.com/fr/\nhttps://www.adeo-web.fr/\nhttps://shotshuop.top\nhttps://offattonlinepaid.weebly.com\nhttps://talktalk08.weebly.com\nhttp://aussieracingcars.com.au/wp-admin/micros.html\nhttp://ceramicasalinas.com/js/outros/UJHYTFJGJFGDFFG\nhttps://cacabox.fr\nhttps://anamiserver.com/do/trkln.php?index=1024084673AZD&id=tipysuyopsrtoiiswyw&url=aHR0cHM6Ly9oaXJvbWktc29mdC5jb20v\nhttps://studioclic53.com\nhttps://offattonlinepaid.weebly.com/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttp://shawcawebmailserver.weebly.com/\nhttps://bsdrsorg.in\nhttps://shelaccountfrackspaceusers.weebly.com/\nhttp://shawcawebmailserver.weebly.com/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://banque-five.vercel.app/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://banque-five.vercel.app/\nhttps://shelaccountfrackspaceusers.weebly.com\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://griselda.com.ua", "modified": "2025-02-01T00:01:06.239000", "created": "2025-01-02T11:10:35.063000", "tags": [ "nie podano", "www tls", "nazwa pospolita", "kod odpowiedzi", "script", "polityka zasobw", "raport do", "dugo treci", "serwer", "ochrona xxss", "office open", "xml document", "xml spreadsheet", "ms word", "ms excel", "document", "pdf carta", "letter", "pdf aoscx", "pdf new", "form", "fall", "zero", "sarah" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 27, "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 357, "domain": 4, "hostname": 2 }, "indicator_count": 400, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6761baa2ec110f1e4b1a05e9", "name": "https://aplikacja.ceidg.gov.pl/?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4", "description": "Here is the full list of results from the search for the most-travelled website in the world: www.ceidg.gov.au.co.uk.com..", "modified": "2025-01-31T09:02:46.544000", "created": "2024-12-17T17:53:38.963000", "tags": [ "dostawa", "configoverride", "continuity", "pageparam s", "iframedelay", "autoxhr", "historia", "angular", "backbone", "ember", "nazwa rekordu", "aaaaa", "nazwa", "hasze", "adresy url", "nazwa https" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 35, "domain": 14, "hostname": 14, "FileHash-SHA256": 213, "FileHash-MD5": 65, "FileHash-SHA1": 65 }, "indicator_count": 406, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "677076d5a3d1a5495804ee58", "name": "3 - Eksplorator Windows.lnk 2b7827fa8f8b2e19a10da8c5b0c744d064a077bde7347153767c16191eb272fe", "description": "2b7827fa8f8b2e19a10da8c5b0c744d064a077bde7347153767c16191eb272fe\nshell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1} (PID: 4272)\nCreation date 1970-01-01T00:00:00Z\nAccess date 1970-01-01T00:00:00Z\nModification date 1970-01-01T00:00:00Z\nCommand line arguments: shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}\nThe full text of the Microsoft Root Certificate Authority 2010, signed by Microsoft, has been published online by the company's website, the Windows Project, and the BBC News Channel, as well as the official website.", "modified": "2025-01-27T00:04:22.341000", "created": "2024-12-28T22:08:21.035000", "tags": [ "name microsoft", "valid from", "valid", "valid usage", "serial number", "authority", "thumbprint", "status valid", "all algorithm", "timestamp pca", "date", "access date", "command line", "image20073", "windows", "produkty", "pyta dvd", "pro asus", "hashdb narodowa", "oprogramowania", "nsrl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 65, "FileHash-SHA256": 342, "hostname": 1, "URL": 3 }, "indicator_count": 488, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "490 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676df7b699b17adb549dbd7a", "name": "185.253.212.22", "description": "TrojanDropper:Win32/Cutwail.12142-1: Trojan Cafeini-13 wedi dweud wrz 2023, a year before the release of the malicious software.", "modified": "2025-01-26T01:02:51.890000", "created": "2024-12-27T00:41:23.901000", "tags": [ "lowfi", "wygraj trojan", "cafeini13", "trojandropper", "wygraj" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wygraj", "display_name": "Wygraj", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 1, "URL": 170, "FileHash-SHA256": 1836, "domain": 47, "hostname": 67, "FileHash-MD5": 973, "FileHash-SHA1": 972 }, "indicator_count": 4066, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "491 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676bdbfa7f80c993aea15659", "name": "chat-wahtsazpp.com phishing", "description": "Here is a full list of links to the latest round of chat-wahtsazpp.com (chatwhatsapps) and newgrupwatsappinvite (join)", "modified": "2025-01-08T01:55:35.758000", "created": "2024-12-25T10:18:34.088000", "tags": [ "no expiration", "url http", "url https" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 173, "hostname": 95, "domain": 5, "FileHash-SHA256": 1 }, "indicator_count": 274, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676b2437cad5651044c21708", "name": "mdec.nelreports.net/api/report?cat=schemas", "description": "0060 0 1 0 D 0 0 0 0 0 0 0 0 4 0 C 2 8 0 0 6 0 0 0 0 0 0 0 0 2 0 6 1 . A 0070 4 0 0 3 0 0 0 0 0 0 0 0 9 0 3 0 A 0 0 1 0 0 0 0 0 0 0 0 4 8 1 8 @ . 0080 D 0 0 0 0 0 0 0 0 0 0 0 2 4 0 C 6 8 0 0 0 0 0 0 0 0 0 0 1 2 0 6 . 0090 3 4 0 0 0 0 0 0 0 0 0 0 0 9 0 3 1 A 0 0 0 0 0 0 0 0 8 0 8 4 0 1 4 . 00a0 0 D 0 0 0 0 0 0 0 0 4 0 C 2 8 0 0 6 0 0 0 0 0 0 0 2 0 6 1 4 0 . 00c0 0 0 0 0 0 0 0 0 0 2 4 0 C 6 8 0 0 0 0 0 0 0 0 0 1 2 0 6 3 4 . 4 00d0 0 0 0 0 0 0 0 0 0 0 0 0 9 0 3 1 A 0 0 0 0 0 0 0 0 8 0 8 4 0 1 0 D . 00e0 0 0 0 0 0 0 0 0 4 0 C 2 8 0 0 6 0 0 0 0 0 0 0 2 0 6 1 4 0 0 3 . 00f0 0 0 0 0 0 0 0 0 9 0 3 0 A 0 0 1 0 0 0 0 0 0 0 0 4 8 1 8 D 0 0 0 . 0100 0 0 0 0 0 0 0 0 2 4 0 C 6 8 0 0 0 0 0 0 0 0 0 1 2 0 6 3 4 0 0 . 0110 0 0 0 0 0 0 0 0 0 9 0 3 1 A 0 0 0 0 0 0 0 0 8 0 8 4 0 1 0 D 0 0 . 0120 0 0 0 0 0 0 4 0 C 2 8 0 0 6 0 0 0 0 0 0 0 0 2 0 6 1 4 0 0 3 0 0 . 0130 0 0 0 0 0 0 9 0 3 0 A 0 0 1 0 0 0 0 0 0 0 0 4 8 1 8 D 0 0 0 0 0 .", "modified": "2025-01-08T01:55:34.435000", "created": "2024-12-24T21:14:31.955000", "tags": [ "a mi", "c mi", "sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 53, "FileHash-SHA1": 52, "FileHash-SHA256": 64, "URL": 5, "hostname": 1 }, "indicator_count": 175, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6769beaee1a21227b5411707", "name": "svchost.com", "description": "if(3.0) =t+o, i, as a result of an error, if i=0, is any longer than a single word, then i(i) is a", "modified": "2025-01-08T01:55:33.905000", "created": "2024-12-23T19:49:02.840000", "tags": [ "remoteurl", "remoteip", "65535", "error", "date", "fingerprintjs", "typeof e", "promise", "copyright", "murmurhash3", "karan lyons", "msstream", "click", "whasz" ], "references": [ "https://svchost.com/js/fingerprint/iife.min.js", "http://ww16.test.windows.svchost.com/?sub1=20231019-1240-0363-984e-cb61eec5c9c7", "http://svchost.com/?fp=-3", "http://svchost.com/?fp=c9ef88c56cbdd266b94e81c85887b3b5", "http://svchost.com/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 84, "FileHash-SHA1": 80, "FileHash-SHA256": 424, "IPv4": 1, "URL": 131, "hostname": 45, "domain": 16 }, "indicator_count": 781, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67708ba710e9e0f7fc0fccae", "name": "w8i9eHkHOwWwQlX.exe.bin 8b1c6d1c4df109ef648f36a31e59e492c9752b0acf0eea26a0a75b2398c5d86c", "description": "8b1c6d1c4df109ef648f36a31e59e492c9752b0acf0eea26a0a75b2398c5d86c\nlnk - \u00c2\u00a31.5m - - is the most accurate description of the malicious software that can attack a computer. online, and it can be found on the web.", "modified": "2025-01-08T01:55:32.167000", "created": "2024-12-28T23:37:11.927000", "tags": [ "windows media", "click", "change", "document cloud", "autoit v3", "scite script", "remote desktop", "pink candy", "check", "hancom office", "hancell", "appearance", "python", "module docs", "microsoft clip", "math input", "microsoft word", "data sources", "hancom document", "designer", "firewall" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 222, "FileHash-MD5": 17, "FileHash-SHA1": 17, "URL": 2 }, "indicator_count": 258, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6770701bfb2edd8c8d0f40ac", "name": "WinX.zip 234de8ea1eb6ad5a35118bf53be27d066da32870f620b34858e0d1e8aab8d536", "description": "c:/windows/system32/WindowsPowerShell/v1.0/powershell.exe start-process\n2b7827fa8b2e19a10da8c5b0c744d064a077bde73767c16191eb272fe", "modified": "2025-01-08T01:55:31.379000", "created": "2024-12-28T21:39:39.706000", "tags": [ "zarzdzanie", "meneder", "podgld", "zagroenia", "panel", "wsplnota", "vhash", "authentihash", "imphash", "ssdeep" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 30, "FileHash-SHA1": 15, "FileHash-SHA256": 23, "URL": 2 }, "indicator_count": 70, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6776912f7ab1007f1f48f9cd", "name": "File GABB32 0.5.24.exe z\u0142o\u015bliwe artefakty zwi\u0105zane z ip4 172.217.7.174", "description": "https://www.hybrid-analysis.com/sample/7a356bbde729cbdaf1d6ffef50829cac8dc4cf7ecf98f4eaf486b57b70eed20c\nPlik has released a series of SHA256 results, which show some of the most interesting snippets of data so far, as well as some interesting ones, on the subject of computer security and security.", "modified": "2025-01-08T01:55:28.837000", "created": "2025-01-02T13:14:23.467000", "tags": [ "plik sha256", "data" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 7, "FileHash-SHA1": 7, "FileHash-SHA256": 9, "URL": 2 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "http://ww16.test.windows.svchost.com/?sub1=20231019-1240-0363-984e-cb61eec5c9c7", "fec126b5fc67fefdf27ad52ae8c829836f47d29eef6eea8f77c86c996969a9da - Overview.html", "https://matomo.org https://matomo.www.gov.pl/analytics/js/container_68lYTZ79.js", "https://www.filescan.io/uploads/67619a0f99caec9a276f9efd/reports/92e63ab1-1ebd-41a7-90da-f842f0b90392/details", "http://svchost.com/?fp=c9ef88c56cbdd266b94e81c85887b3b5", "http://svchost.com/?fp=-3", "http://svchost.com/", "https://svchost.com/js/fingerprint/iife.min.js" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Wygraj" ], "industries": [], "unique_indicators": 13811 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/mountainbox.fr", "whois": "http://whois.domaintools.com/mountainbox.fr", "domain": "mountainbox.fr", "hostname": "home.mountainbox.fr" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 19, "pulses": [ { "id": "69c0a0e53959e34f9b4b2318", "name": "3 - Eksplorator Windows.lnk 2b7827fa8f8b2e19a10da8c5b0c744d06 clone by Arek-BTC", "description": "", "modified": "2026-03-23T02:09:41.649000", "created": "2026-03-23T02:09:41.649000", "tags": [ "name microsoft", "valid from", "valid", "valid usage", "serial number", "authority", "thumbprint", "status valid", "all algorithm", "timestamp pca", "date", "access date", "command line", "image20073", "windows", "produkty", "pyta dvd", "pro asus", "hashdb narodowa", "oprogramowania", "nsrl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "677076d5a3d1a5495804ee58", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 65, "FileHash-SHA256": 342, "hostname": 1, "URL": 3 }, "indicator_count": 488, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "70 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6761c6d68582c49eff306fe6", "name": "Likely malicious Google Analytics Alternative - App & Web Analytics - Matomo", "description": "The full text of the \"suspicious\"obfuscation using unescape has been published on the website tylabs.com, as well as the official release of a new version of PDF.", "modified": "2025-05-14T21:24:25.364000", "created": "2024-12-17T18:45:42.250000", "tags": [ "bitcoin address", "didier stevens", "didierstevens", "bitcoinaddress", "june", "copyright", "t1027", "unesc", "unescape", "flash define", "matomo", "string", "date", "sufeffxa0", "regexp", "please", "blob", "null", "tag manager", "link", "url https", "ipv4", "url http", "learn", "it for", "no credit", "cloud trial", "start", "contact", "matomo team", "help", "free", "easy", "tools" ], "references": [ "https://matomo.org https://matomo.www.gov.pl/analytics/js/container_68lYTZ79.js", "https://www.filescan.io/uploads/67619a0f99caec9a276f9efd/reports/92e63ab1-1ebd-41a7-90da-f842f0b90392/details" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 62, "YARA": 8, "domain": 83, "URL": 657, "email": 3, "hostname": 152, "IPv4": 15, "CIDR": 1, "FileHash-SHA1": 57, "FileHash-SHA256": 734 }, "indicator_count": 1772, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676b5a7cd903a3fec3a68ba7", "name": "fec126b5fc67fefdf27ad52ae8c829836f47d29eef6eea8f77c86c996969a9da - Overview", "description": "We use cookies to store information on our website, but we do not store any personally identifiable data, so we may use them to monitor how we interact with your browser and send messages to our users.", "modified": "2025-05-14T21:23:57.367000", "created": "2024-12-25T01:06:04.499000", "tags": [ "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "nothreat osint", "znaleziono cz", "werdykt brak", "duration", "analytics", "reject all", "cookie ga", "file details", "url details", "rules extracted", "alexa" ], "references": [ "fec126b5fc67fefdf27ad52ae8c829836f47d29eef6eea8f77c86c996969a9da - Overview.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 70, "FileHash-SHA256": 88, "domain": 8, "hostname": 16 }, "indicator_count": 182, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6761b182afcf75c534592978", "name": "https://www.gov.pl/web/po-jelenia-gora/ 1d377a4d5113569a68325ac055eeadfc1cbda39a0f299820f15be09342a575c7", "description": "Hasze - zidentyfikowano 43-year-old Hasze, also known as Gariad, is on offer for \u00a31.5m in donations from the European Union.", "modified": "2025-05-14T21:14:42.256000", "created": "2024-12-17T17:14:42.127000", "tags": [ "nazwa", "b3rze", "refts0", "hasze", "adresy url", "nazwa https", "id76c1f", "idn1", "sendimage0", "idn0" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 127, "domain": 4, "URL": 74, "hostname": 3, "FileHash-MD5": 28, "FileHash-SHA1": 28, "email": 1 }, "indicator_count": 265, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67709b347e368914cb5d1fa2", "name": "ld869rwRuHeO9Tw.exe 1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada", "description": "https://www.hybrid-analysis.com/sample/1d773d866966940f042d442b9e0cec638e733a83f7137cbdd4e70d4cb9803ada/677086f7a2798798250fafcd\nLastcode analysis wedi cyhoeddi i'wadu cyffredinol, \u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m.", "modified": "2025-05-14T21:11:16.436000", "created": "2024-12-29T00:43:32.094000", "tags": [ "sha256 file", "type type", "language chi2", "image english", "us 1", "1 upx1", "monitoruj", "rozszerzenia", "kali linux", "live boot", "apple m1", "kolekcja dvd", "sound pool", "hashdb narodowa", "oprogramowania", "nsrl", "programfiles", "kopiuj md5", "kopiuj sha1", "skopiuj sha256", "sha1", "sha256", "runtime process", "description zip", "type", "size", "error", "null", "install", "bitcoin", "python", "calendar", "xorist", "path", "refresh", "body", "span", "green", "win32", "designer", "filler", "tools", "black", "wallpaper", "zapis", "pulpit", "autoit", "bill", "light", "stars", "look", "verify", "restart", "desktop" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 491, "FileHash-MD5": 452, "FileHash-SHA1": 458, "BitcoinAddress": 1, "URL": 39, "domain": 66, "hostname": 18 }, "indicator_count": 1525, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "676ecc52456eb31564512705", "name": "jusched.exe UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar i John Reiser", "description": "192.168.0.194 23.253.126.58 HTTP 106 GET /post/echo HTTP/1.1\nWersja pliku: 6.0.100.33\nMaszyna docelowa: Procesory Intel 386 lub nowsze oraz zgodne procesory\nPunkt wej\u015bcia: 0x00076A70\nLiczba sekcji: 3\nA security alert issued by the European Commission has identified a malicious process masquerading as the legitimate \"svchost.exe\" operating system and executing from an uncommon location in an unknown location.", "modified": "2025-05-14T20:50:19.966000", "created": "2024-12-27T15:48:34.024000", "tags": [ "sha256", "java", "win32 exe", "intel", "utc first", "submission", "file version", "platform se", "contained", "vhash", "ssdeep", "crypter", "poudel date", "nextron", "lazarus group", "system file", "anomaly id", "svchost rule", "windows system", "roth", "patrick bareiss", "anton kutepov", "winreagent", "vitali kremez", "wykryto scraper", "jackpos", "sopsop", "security" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 18, "FileHash-SHA1": 14, "FileHash-SHA256": 91, "domain": 30, "URL": 190, "hostname": 65, "CVE": 2 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6776887cdd7b2fd90f7fdb63", "name": "http://2.16.6.6/ MD5-8c69ea7049dbdf22081e78945d63cb76 2ad2ad0002ad2ad08c2ad2ad2ad2ada14926db9b7be3a1010242195721efd9", "description": "https://aplikacja.ceidg.gov.pl/?Id=7a025cc6-5167-43cf-947f-387a3b830778\nhttps://aplikacja.ceidg.gov.pl/favicon.ico\n2.16.6.6\nhttp://2.16.6.6/\nhttps://2.16.6.6/\nOdcisk palca JARM\n2ad2ad0002ad2ad08c2ad2ad2ad2ada14926db9b7be3a1010242195721efd9", "modified": "2025-02-09T04:44:15.872000", "created": "2025-01-02T12:37:16.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 1, "URL": 836, "domain": 20, "hostname": 257, "FileHash-SHA256": 66, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1182, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "477 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67768113826cf5a2959c0c97", "name": "ghn2.16.6.6 hjjgh", "description": "", "modified": "2025-02-09T04:44:15.025000", "created": "2025-01-02T12:05:39.474000", "tags": [ "configoverride", "continuity", "pageparams", "iframedelay", "autoxhr", "history", "angular", "backbone", "ember", "crossdomain" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 4, "URL": 26, "hostname": 2, "domain": 2, "FileHash-SHA256": 25 }, "indicator_count": 59, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "477 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "677de70273499f868768ca1f", "name": "pwacka.com strona g\u0142\u00f3wna.mountainbox.fr", "description": "aplikacja/plik wykonywalny x\nhttp://159.65.59.62/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl", "modified": "2025-02-07T02:01:54.054000", "created": "2025-01-08T02:46:26.023000", "tags": [ "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "msdos", "ms windows", "pe32", "intel", "plik", "instrukcja", "tekst w", "utf16 unicode", "z terminatorami", "crlf", "rodzestwo", "win32", "vitro", "tekst", "https ostatni", "https dane", "v3 numer", "odcisk palca", "wystawca", "gb st", "greater", "manchester cn", "sectigo", "meneder proxy", "identyfikator", "dane", "nginx wano", "nie wczeniej", "nie po", "algorytm", "rsa klucz", "binchmod", "awinwkqonp", "usrbincurl o", "mips", "mipsi wersja", "sysv", "nazwa typ", "md5 nazwa", "gnulinux", "elf binary", "upx compression", "roth", "nextron", "info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1058, "FileHash-MD5": 161, "FileHash-SHA1": 118, "domain": 132, "hostname": 116, "URL": 253, "email": 5, "YARA": 1 }, "indicator_count": 1844, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "479 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6776742b3dc3a0e46cc14a9a", "name": "Chrome Cache Entry: 843 MD5-16cba75f4b9969077ff30bea2f494e12, sha256-241ced7f220982f5679a64cc6db34ed42cd21274508cc5814616d9efe374afde", "description": "Matched URL\tScan:\nhttps://www.adorno.pl/\nhttps://www.portugalvineyards.com/fr/\nhttps://www.adeo-web.fr/\nhttps://shotshuop.top\nhttps://offattonlinepaid.weebly.com\nhttps://talktalk08.weebly.com\nhttp://aussieracingcars.com.au/wp-admin/micros.html\nhttp://ceramicasalinas.com/js/outros/UJHYTFJGJFGDFFG\nhttps://cacabox.fr\nhttps://anamiserver.com/do/trkln.php?index=1024084673AZD&id=tipysuyopsrtoiiswyw&url=aHR0cHM6Ly9oaXJvbWktc29mdC5jb20v\nhttps://studioclic53.com\nhttps://offattonlinepaid.weebly.com/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttp://shawcawebmailserver.weebly.com/\nhttps://bsdrsorg.in\nhttps://shelaccountfrackspaceusers.weebly.com/\nhttp://shawcawebmailserver.weebly.com/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://banque-five.vercel.app/\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://banque-five.vercel.app/\nhttps://shelaccountfrackspaceusers.weebly.com\nhttp://shelaccountfrackspaceusers.weebly.com/\nhttps://griselda.com.ua", "modified": "2025-02-01T00:01:06.239000", "created": "2025-01-02T11:10:35.063000", "tags": [ "nie podano", "www tls", "nazwa pospolita", "kod odpowiedzi", "script", "polityka zasobw", "raport do", "dugo treci", "serwer", "ochrona xxss", "office open", "xml document", "xml spreadsheet", "ms word", "ms excel", "document", "pdf carta", "letter", "pdf aoscx", "pdf new", "form", "fall", "zero", "sarah" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 27, "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 357, "domain": 4, "hostname": 2 }, "indicator_count": 400, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://home.mountainbox.fr", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://home.mountainbox.fr", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780294789.171391 }