{ "type": "URL", "indicator": "https://netprotect.io/r-a-k", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://netprotect.io/r-a-k", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3808481456, "indicator": "https://netprotect.io/r-a-k", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681f89cbab1a4574c464ad5b", "name": "f83991c8-f2d9-5583-845a-d105034783ab", "description": "https://www.virustotal.com/gui/file/e79f57b603370d4cd4ab1d757833995b89c7d79c9071c75d72c6d082ba0a7ea4/detection\nA chronology of key events in the history of the United States:-1.1-2 January 2020.. and 1 February 2021.. (c.9/11):.", "modified": "2025-05-10T17:15:55.933000", "created": "2025-05-10T17:15:55.933000", "tags": [ "detects", "xored url", "roth", "nextron", "deepgit", "avast software", "gmbh", "perl dev", "digiread", "avid editor", "confuserex mod", "aspirecrypt", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 12, "FileHash-SHA1": 11, "FileHash-SHA256": 17, "YARA": 53, "URL": 55, "domain": 4, "hostname": 7, "CVE": 1 }, "indicator_count": 160, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "344 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67a9f3def74f96146bc342d5", "name": "cobalt_loader_unpacked.exe", "description": "A guide to the Cobaltloader, a 32-bit executable for Windows, has been published by the University of Oxford.. and its website is published on the same day as the release.", "modified": "2025-02-10T12:41:02.752000", "created": "2025-02-10T12:41:02.752000", "tags": [ "sha256", "sha1", "size", "ms windows", "copy ssdeep", "copy imphash", "call", "imagescnmemread", "imagescncntcode", "e5a596d6h", "rsp20h", "e5a595f0h", "e5a595dch", "rsp10h", "rsp18h", "rsp04h", "rsp08h", "rsp0ch", "rax05h", "themida", "thumbprint md5", "serial number", "vs2022", "symantec time", "stamping", "from", "algorithm", "thumbprint", "globalsign root", "submission", "w5k0fa2", "connection", "i64d", "http", "userprofile", "studio", "ldap", "detail", "cdecl sol", "socks5 connect", "ca file", "error", "class", "combo", "delta", "bind", "unknown", "void", "rest", "problem", "procin", "httpports", "ipv4 address", "homenet", "externalnet", "tgi hunt", "curl", "ip address", "et hunting", "dotted quad", "clientendpoint", "perimeter", "hunting", "informational", "policy", "outbound", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 23, "FileHash-SHA256": 177, "FileHash-SHA1": 7, "YARA": 52, "email": 7, "IPv4": 38, "URL": 154, "domain": 14, "hostname": 58 }, "indicator_count": 530, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "433 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6580d422fb57aab8e21c1f39", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password", "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-18T23:22:10.482000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d83bfd115be1f92d75a9", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password [Octoseek]", "description": "", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-19T17:51:55.338000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": "6580d422fb57aab8e21c1f39", "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d83e20634ac0d58ceca9", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password [Octoseek]", "description": "", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-19T17:51:58.995000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": "6580d422fb57aab8e21c1f39", "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "DNS Query for Anonfiles.com Domain", "discord.com", "MALWARE_Win_StormKitty", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community", "https://rdap.arin.net/registry/entity/CLOUD14", "Python Image Load By Non-Python Process.yml", "indicator_packed.yar", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "checkip.dyndns.com", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "qbittorrent.exe", "api.anonfiles.com", "Potential Python DLL SideLoading.yml", "Traffic 13.107.4.52:80 (TCP)", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "checkip.dyndns.org", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "EaZy Client.exe", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "indicator_suspicious.yar" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Witchetty APT Group" ], "malware_families": [ "Trojan.msil/stealer", "Lokbit", "Blueshell", "Witchetty", "Therat", "Mac.malware" ], "industries": [], "unique_indicators": 10166 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/netprotect.io", "whois": "http://whois.domaintools.com/netprotect.io", "domain": "netprotect.io", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681f89cbab1a4574c464ad5b", "name": "f83991c8-f2d9-5583-845a-d105034783ab", "description": "https://www.virustotal.com/gui/file/e79f57b603370d4cd4ab1d757833995b89c7d79c9071c75d72c6d082ba0a7ea4/detection\nA chronology of key events in the history of the United States:-1.1-2 January 2020.. and 1 February 2021.. (c.9/11):.", "modified": "2025-05-10T17:15:55.933000", "created": "2025-05-10T17:15:55.933000", "tags": [ "detects", "xored url", "roth", "nextron", "deepgit", "avast software", "gmbh", "perl dev", "digiread", "avid editor", "confuserex mod", "aspirecrypt", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 12, "FileHash-SHA1": 11, "FileHash-SHA256": 17, "YARA": 53, "URL": 55, "domain": 4, "hostname": 7, "CVE": 1 }, "indicator_count": 160, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "344 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67a9f3def74f96146bc342d5", "name": "cobalt_loader_unpacked.exe", "description": "A guide to the Cobaltloader, a 32-bit executable for Windows, has been published by the University of Oxford.. and its website is published on the same day as the release.", "modified": "2025-02-10T12:41:02.752000", "created": "2025-02-10T12:41:02.752000", "tags": [ "sha256", "sha1", "size", "ms windows", "copy ssdeep", "copy imphash", "call", "imagescnmemread", "imagescncntcode", "e5a596d6h", "rsp20h", "e5a595f0h", "e5a595dch", "rsp10h", "rsp18h", "rsp04h", "rsp08h", "rsp0ch", "rax05h", "themida", "thumbprint md5", "serial number", "vs2022", "symantec time", "stamping", "from", "algorithm", "thumbprint", "globalsign root", "submission", "w5k0fa2", "connection", "i64d", "http", "userprofile", "studio", "ldap", "detail", "cdecl sol", "socks5 connect", "ca file", "error", "class", "combo", "delta", "bind", "unknown", "void", "rest", "problem", "procin", "httpports", "ipv4 address", "homenet", "externalnet", "tgi hunt", "curl", "ip address", "et hunting", "dotted quad", "clientendpoint", "perimeter", "hunting", "informational", "policy", "outbound", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 23, "FileHash-SHA256": 177, "FileHash-SHA1": 7, "YARA": 52, "email": 7, "IPv4": 38, "URL": 154, "domain": 14, "hostname": 58 }, "indicator_count": 530, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "433 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6580d422fb57aab8e21c1f39", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password", "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-18T23:22:10.482000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d83bfd115be1f92d75a9", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password [Octoseek]", "description": "", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-19T17:51:55.338000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": "6580d422fb57aab8e21c1f39", "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d83e20634ac0d58ceca9", "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password [Octoseek]", "description": "", "modified": "2024-01-17T23:03:40.729000", "created": "2023-12-19T17:51:58.995000", "tags": [ "contacted", "ssl certificate", "group", "toolset", "attacks", "governments", "middle east", "dalbit", "march", "witchetty", "blueshell", "execution", "lockbit", "malware", "backdoor", "tsara brashears", "octoseek", "steganographic technique", "proxylogon", "lookback", "lookingfrog", "anonfiles", "publishing", "music", "torrent", "critical", "hallrender", "ttp", "uae", "protection", "macmalware", "linux malware", "apple", "proxyshell", "x4", "zero trust", "youtube", "safebae", "rallypoint", "poemhunter", "eazy client", "africa", "united states", "ta410", "second stage", "Capture Wi-Fi password", "password stealer", "whois whois", "agent tesla", "love", "mirai", "satacom", "miner", "dtrack", "nebula", "cobalt strike", "nanocore", "core", "hacktool" ], "references": [ "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint", "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell", "discord.com", "api.anonfiles.com", "checkip.dyndns.org", "checkip.dyndns.com", "DNS Query for Anonfiles.com Domain", "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon", "INDICATOR SUSPICIOUS_EXE_CC_Regex", "DNS Query for Anonfiles.com Domain", "Traffic 13.107.4.52:80 (TCP)", "MALWARE_Win_StormKitty", "qbittorrent.exe", "EaZy Client.exe", "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community" ], "public": 1, "adversary": "Witchetty APT Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Witchetty", "display_name": "Witchetty", "target": null }, { "id": "BlueShell", "display_name": "BlueShell", "target": null }, { "id": "Lokbit", "display_name": "Lokbit", "target": null }, { "id": "Mac.Malware", "display_name": "Mac.Malware", "target": null }, { "id": "trojan.msil/stealer", "display_name": "trojan.msil/stealer", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": "6580d422fb57aab8e21c1f39", "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1541, "URL": 3782, "domain": 1067, "hostname": 1297, "FileHash-MD5": 110, "FileHash-SHA1": 110, "CVE": 3 }, "indicator_count": 7910, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "822 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://netprotect.io/r-a-k", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://netprotect.io/r-a-k", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776619864.1273534 }