{ "type": "URL", "indicator": "https://nymedsvcsystems.com/ntt/sk.msi", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://nymedsvcsystems.com/ntt/sk.msi", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3447084812, "indicator": "https://nymedsvcsystems.com/ntt/sk.msi", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "638650c73af5f40f7ba6977f", "name": "URLhaus feed IOCs - multiple malware families", "description": "https://urlhaus.abuse.ch/feeds/asn/22612/", "modified": "2022-12-29T18:06:00.139000", "created": "2022-11-29T18:34:47.361000", "tags": [ "emotetheodo", "dridex", "agentteslaexe", "azorultexe", "qakbot", "gozi", "icedid", "dridexopendir", "danabot", "heodo", "trickbot", "azorult", "hawkeye", "arkeistealer", "remcosrat", "agenttesla", "systembc", "kpotstealer", "darkrat", "troldesh", "quasarrat", "stealer", "formbook", "zloader", "phorpiex", "pony", "nanocore", "kpot", "raccoonstealer", "remcos", "loader", "qealler", "luminositylink", "hancitor", "nemty", "servhelper", "netwire", "gandcrab", "loki" ], "references": [ "https://urlhaus.abuse.ch/feeds/asn/22612/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 14, "URL": 8676, "domain": 2891, "hostname": 334 }, "indicator_count": 11915, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "1248 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627eeec6a1d5cf768361920d", "name": "Twitter Feed - JAMESWT_MHT - 13-05-2022", "description": "", "modified": "2022-05-13T23:50:30.388000", "created": "2022-05-13T23:50:30.388000", "tags": [], "references": [ "https://twitter.com/JAMESWT_MHT/status/1525033019316219912" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1 }, "indicator_count": 1, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "1478 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627e6aa0db69a300e7d2f94a", "name": "Bitter", "description": "The full text of James Bond's latest novel, The Theory of Everything, published in the journal of the American Academy of Social Sciences (AASS), as well as the words \"JAMESWT", "modified": "2022-05-13T14:26:40.160000", "created": "2022-05-13T14:26:40.160000", "tags": [ "jameswtmht", "online apt", "bitter", "offline apt", "bitter exe", "bitter xlsx", "bitter na", "xlsx", "bitter msi" ], "references": [ "https://twitter.com/JAMESWT_MHT/status/1525033019316219912" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Sand-Storm", "id": "94093", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_94093/resized/80/avatar_281f69b768.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 27, "URL": 6 }, "indicator_count": 77, "is_author": false, "is_subscribing": null, "subscriber_count": 414, "modified_text": "1478 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://twitter.com/JAMESWT_MHT/status/1525033019316219912", "https://urlhaus.abuse.ch/feeds/asn/22612/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 13521 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/nymedsvcsystems.com", "whois": "http://whois.domaintools.com/nymedsvcsystems.com", "domain": "nymedsvcsystems.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "638650c73af5f40f7ba6977f", "name": "URLhaus feed IOCs - multiple malware families", "description": "https://urlhaus.abuse.ch/feeds/asn/22612/", "modified": "2022-12-29T18:06:00.139000", "created": "2022-11-29T18:34:47.361000", "tags": [ "emotetheodo", "dridex", "agentteslaexe", "azorultexe", "qakbot", "gozi", "icedid", "dridexopendir", "danabot", "heodo", "trickbot", "azorult", "hawkeye", "arkeistealer", "remcosrat", "agenttesla", "systembc", "kpotstealer", "darkrat", "troldesh", "quasarrat", "stealer", "formbook", "zloader", "phorpiex", "pony", "nanocore", "kpot", "raccoonstealer", "remcos", "loader", "qealler", "luminositylink", "hancitor", "nemty", "servhelper", "netwire", "gandcrab", "loki" ], "references": [ "https://urlhaus.abuse.ch/feeds/asn/22612/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 14, "URL": 8676, "domain": 2891, "hostname": 334 }, "indicator_count": 11915, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "1248 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627eeec6a1d5cf768361920d", "name": "Twitter Feed - JAMESWT_MHT - 13-05-2022", "description": "", "modified": "2022-05-13T23:50:30.388000", "created": "2022-05-13T23:50:30.388000", "tags": [], "references": [ "https://twitter.com/JAMESWT_MHT/status/1525033019316219912" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1 }, "indicator_count": 1, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "1478 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627e6aa0db69a300e7d2f94a", "name": "Bitter", "description": "The full text of James Bond's latest novel, The Theory of Everything, published in the journal of the American Academy of Social Sciences (AASS), as well as the words \"JAMESWT", "modified": "2022-05-13T14:26:40.160000", "created": "2022-05-13T14:26:40.160000", "tags": [ "jameswtmht", "online apt", "bitter", "offline apt", "bitter exe", "bitter xlsx", "bitter na", "xlsx", "bitter msi" ], "references": [ "https://twitter.com/JAMESWT_MHT/status/1525033019316219912" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Sand-Storm", "id": "94093", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_94093/resized/80/avatar_281f69b768.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 27, "URL": 6 }, "indicator_count": 77, "is_author": false, "is_subscribing": null, "subscriber_count": 414, "modified_text": "1478 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://nymedsvcsystems.com/ntt/sk.msi", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://nymedsvcsystems.com/ntt/sk.msi", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "APT", "bitter" ], "date_added": "2022-05-13", "last_online": "2022-05-13", "reporter": "JAMESWT_MHT", "host": "nymedsvcsystems.com", "payloads": [ { "filename": null, "file_type": "msi", "md5": "deaeaca791f20ffd641cf287c261ec00", "sha256": "a9362d0dd4cdd64c855333e0fd113421887be498a99b4044ceaf64207b41b196", "signature": "Bitter", "first_seen": "2022-05-13" } ], "error": null }, "from_cache": true, "_cached_at": 1780200665.891179 }