{ "type": "URL", "indicator": "https://idessit.com/fn.msi", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://idessit.com/fn.msi", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3943430283, "indicator": "https://idessit.com/fn.msi", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "66dafec6fc6cae465ed44fdf", "name": "URLhaus Country Feed (Canada) enriched", "description": "", "modified": "2025-06-18T23:40:53.759000", "created": "2024-09-06T13:08:22.353000", "tags": [], "references": [ "https://urlhaus.abuse.ch/feeds/country/CA/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 3, "URL": 83203, "domain": 26579, "email": 1, "hostname": 40137, "FileHash-SHA256": 5936, "CVE": 6 }, "indicator_count": 155869, "is_author": false, "is_subscribing": null, "subscriber_count": 197, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f3dceab0e00ef21b26c0d2", "name": "Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware | Proofpoint US", "description": "", "modified": "2024-10-25T09:02:14.179000", "created": "2024-09-25T09:50:34.622000", "tags": [ "clickfix", "proofpoint", "urls", "north america", "august", "danabot", "google drive", "actor", "base64", "security brief", "lumma stealer", "stealc", "final" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 17, "URL": 13, "domain": 4 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "583 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f36445e10d7882c143c9c1", "name": "Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware | Proofpoint US", "description": "", "modified": "2024-10-25T01:05:04.209000", "created": "2024-09-25T01:15:49.879000", "tags": [ "clickfix", "proofpoint", "urls", "north america", "august", "danabot", "google drive", "actor", "base64", "security brief", "lumma stealer", "stealc", "final" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ChrisTan0", "id": "262536", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 17, "URL": 13, "domain": 4 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 42, "modified_text": "583 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d9eb082ba8ee6c0db1c9cf", "name": "urlhaus.abuse.ch", "description": "", "modified": "2024-10-05T17:03:18.260000", "created": "2024-09-05T17:31:52.439000", "tags": [ "nda0e", "mozi", "clearlynotb", "coinminer", "cobaltstrike", "bitsight", "guloader", "redlinestealer", "stealc", "lummastealer", "vidar", "ransomware", "remcosrat", "asyncrat", "gandcrab", "agenttesla", "amadey", "systembc", "recordbreaker", "quasarrat", "spynote", "formbook", "babadeda", "metasploit", "metastealer", "loki", "blackmoon", "loader", "raccoonstealer", "piratestealer", "dridex", "cobalt strike", "stormkitty", "darktortilla", "venomrat", "sliver", "avemariarat", "neshta", "triada", "fakechrome", "grayware", "danabot", "darkgate", "connectback", "troldesh", "rhadamanthys", "nukesped", "tofsee", "purplefox", "earthworm", "azorult", "redosdru", "getshell", "donut", "aurora stealer", "laplasclipper", "redline", "wingo", "flyagent", "darkside", "badpotato", "juicypotato", "dharma", "casbaneiro", "clearfake", "parallax", "parallaxrat", "phonk", "qakbot", "purecrypter", "revengerat" ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 95, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "JohnnyCS", "id": "293079", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 9, "FileHash-MD5": 3, "FileHash-SHA1": 8, "URL": 7927, "domain": 119, "hostname": 162 }, "indicator_count": 8228, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "602 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66c3d00ac6d768215cd670f8", "name": "URLHaus data - 19-08-2024", "description": "", "modified": "2024-09-18T23:04:39.329000", "created": "2024-08-19T23:06:50.678000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "DanaBot", "ascii", "base64-loader", "Encoded", "NetSupport", "NetSupportRAT", "SocGholish", "botnetdomain", "apk", "Avastavv.apk", "SpyNote", "dropped-by-PrivateLoader", "SystemBC", "RedLineStealer", "encrypted", "Socks5Systemz", "exe", "rat", "RemcosRAT", "hta", "AgentTesla", "rev-base64-loader", "GuLoader", "opendir", "doc", "xworm", "LummaStealer", "Formbook", "gz", "dll", "Stealc", "DarkGate", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 14, "hostname": 9 }, "indicator_count": 1023, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "619 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/", "https://urlhaus.abuse.ch/feeds/country/CA/", "https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering", "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 172303 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/idessit.com", "whois": "http://whois.domaintools.com/idessit.com", "domain": "idessit.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "66dafec6fc6cae465ed44fdf", "name": "URLhaus Country Feed (Canada) enriched", "description": "", "modified": "2025-06-18T23:40:53.759000", "created": "2024-09-06T13:08:22.353000", "tags": [], "references": [ "https://urlhaus.abuse.ch/feeds/country/CA/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 3, "URL": 83203, "domain": 26579, "email": 1, "hostname": 40137, "FileHash-SHA256": 5936, "CVE": 6 }, "indicator_count": 155869, "is_author": false, "is_subscribing": null, "subscriber_count": 197, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f3dceab0e00ef21b26c0d2", "name": "Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware | Proofpoint US", "description": "", "modified": "2024-10-25T09:02:14.179000", "created": "2024-09-25T09:50:34.622000", "tags": [ "clickfix", "proofpoint", "urls", "north america", "august", "danabot", "google drive", "actor", "base64", "security brief", "lumma stealer", "stealc", "final" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 17, "URL": 13, "domain": 4 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "583 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f36445e10d7882c143c9c1", "name": "Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware | Proofpoint US", "description": "", "modified": "2024-10-25T01:05:04.209000", "created": "2024-09-25T01:15:49.879000", "tags": [ "clickfix", "proofpoint", "urls", "north america", "august", "danabot", "google drive", "actor", "base64", "security brief", "lumma stealer", "stealc", "final" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ChrisTan0", "id": "262536", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 17, "URL": 13, "domain": 4 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 42, "modified_text": "583 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d9eb082ba8ee6c0db1c9cf", "name": "urlhaus.abuse.ch", "description": "", "modified": "2024-10-05T17:03:18.260000", "created": "2024-09-05T17:31:52.439000", "tags": [ "nda0e", "mozi", "clearlynotb", "coinminer", "cobaltstrike", "bitsight", "guloader", "redlinestealer", "stealc", "lummastealer", "vidar", "ransomware", "remcosrat", "asyncrat", "gandcrab", "agenttesla", "amadey", "systembc", "recordbreaker", "quasarrat", "spynote", "formbook", "babadeda", "metasploit", "metastealer", "loki", "blackmoon", "loader", "raccoonstealer", "piratestealer", "dridex", "cobalt strike", "stormkitty", "darktortilla", "venomrat", "sliver", "avemariarat", "neshta", "triada", "fakechrome", "grayware", "danabot", "darkgate", "connectback", "troldesh", "rhadamanthys", "nukesped", "tofsee", "purplefox", "earthworm", "azorult", "redosdru", "getshell", "donut", "aurora stealer", "laplasclipper", "redline", "wingo", "flyagent", "darkside", "badpotato", "juicypotato", "dharma", "casbaneiro", "clearfake", "parallax", "parallaxrat", "phonk", "qakbot", "purecrypter", "revengerat" ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 95, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "JohnnyCS", "id": "293079", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 9, "FileHash-MD5": 3, "FileHash-SHA1": 8, "URL": 7927, "domain": 119, "hostname": 162 }, "indicator_count": 8228, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "602 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66c3d00ac6d768215cd670f8", "name": "URLHaus data - 19-08-2024", "description": "", "modified": "2024-09-18T23:04:39.329000", "created": "2024-08-19T23:06:50.678000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "DanaBot", "ascii", "base64-loader", "Encoded", "NetSupport", "NetSupportRAT", "SocGholish", "botnetdomain", "apk", "Avastavv.apk", "SpyNote", "dropped-by-PrivateLoader", "SystemBC", "RedLineStealer", "encrypted", "Socks5Systemz", "exe", "rat", "RemcosRAT", "hta", "AgentTesla", "rev-base64-loader", "GuLoader", "opendir", "doc", "xworm", "LummaStealer", "Formbook", "gz", "dll", "Stealc", "DarkGate", "script" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 14, "hostname": 9 }, "indicator_count": 1023, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "619 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://idessit.com/fn.msi", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://idessit.com/fn.msi", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "DanaBot" ], "date_added": "2024-08-19", "last_online": "2024-09-16", "reporter": "anonymous", "host": "idessit.com", "payloads": [ { "filename": null, "file_type": "msi", "md5": "4ec074c0e895d7b60d4518a25681c1f5", "sha256": "83c9a8504decec28bc73c3f7130d5aeffe64d2b21982f4afb234ec1f4f51dcd1", "signature": "DanaBot", "first_seen": "2024-09-02" }, { "filename": null, "file_type": "msi", "md5": "b879d804f59086a464dc2bb22a4f5406", "sha256": "fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7", "signature": "DanaBot", "first_seen": "2024-08-19" } ], "error": null }, "from_cache": true, "_cached_at": 1780223258.1318653 }