{ "type": "URL", "indicator": "https://paste.ee/d/TG5jqZvY/0", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://paste.ee/d/TG5jqZvY/0", "type": "url", "type_title": "URL", "validation": [ { "source": "whitelist", "message": "Whitelisted domain paste.ee", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4074278069, "indicator": "https://paste.ee/d/TG5jqZvY/0", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "684a1371679552059c6f93a2", "name": "URLHaus data - 11-06-2025", "description": "", "modified": "2025-07-11T23:01:11.967000", "created": "2025-06-11T23:38:25.042000", "tags": [ "botnetdomain", "censys", "elf", "mirai", "ua-wget", "sh", "gafgyt", "RemcosRAT", "AveMariaRAT", "xworm", "c2-monitor-auto", "dropped-by-amadey", "rev-base64-loader", "VIPKeylogger", "exe", "ftp", "geofenced", "GorillaBotnet", "GorillaStress", ".exe", "AsyncRAT", "connectwise", "rustystealer", "banker", "latam", "trojan", "bash", "wget", "ps1", "hta", "CobaltStrike", "lnk", "xml-opendir", "backdoor", "sshdkit", "hajime", "miner", "gz", "ua-curl", "macho", "CoinMiner", "SMB", "chmod", "Metasploit", "vbscript", "python", "yaml", "Smoke Loader", "Formbook", "DarkTortilla", "a310Logger", "Mozi" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 68, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 730, "hostname": 41, "domain": 11 }, "indicator_count": 782, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "323 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68463505b9e803694da3628c", "name": "Microsoft.Win32.TaskScheduler.dll", "description": "8c66d9087118b17ccaa62eb83f3542c1", "modified": "2025-07-09T01:02:01.470000", "created": "2025-06-09T01:12:37.802000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 124, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 15, "hostname": 45 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "326 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6844abbf066f7402bce2a61c", "name": "Katz Stealer", "description": "", "modified": "2025-07-07T21:00:15.349000", "created": "2025-06-07T21:14:39.087000", "tags": [ "KatzStealer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Katz Stealer", "display_name": "Katz Stealer", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 125, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 14, "hostname": 43 }, "indicator_count": 314, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "327 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Katz stealer" ], "industries": [], "unique_indicators": 1166 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/paste.ee", "whois": "http://whois.domaintools.com/paste.ee", "domain": "paste.ee", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "684a1371679552059c6f93a2", "name": "URLHaus data - 11-06-2025", "description": "", "modified": "2025-07-11T23:01:11.967000", "created": "2025-06-11T23:38:25.042000", "tags": [ "botnetdomain", "censys", "elf", "mirai", "ua-wget", "sh", "gafgyt", "RemcosRAT", "AveMariaRAT", "xworm", "c2-monitor-auto", "dropped-by-amadey", "rev-base64-loader", "VIPKeylogger", "exe", "ftp", "geofenced", "GorillaBotnet", "GorillaStress", ".exe", "AsyncRAT", "connectwise", "rustystealer", "banker", "latam", "trojan", "bash", "wget", "ps1", "hta", "CobaltStrike", "lnk", "xml-opendir", "backdoor", "sshdkit", "hajime", "miner", "gz", "ua-curl", "macho", "CoinMiner", "SMB", "chmod", "Metasploit", "vbscript", "python", "yaml", "Smoke Loader", "Formbook", "DarkTortilla", "a310Logger", "Mozi" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 68, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 730, "hostname": 41, "domain": 11 }, "indicator_count": 782, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "323 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68463505b9e803694da3628c", "name": "Microsoft.Win32.TaskScheduler.dll", "description": "8c66d9087118b17ccaa62eb83f3542c1", "modified": "2025-07-09T01:02:01.470000", "created": "2025-06-09T01:12:37.802000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 124, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 15, "hostname": 45 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "326 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6844abbf066f7402bce2a61c", "name": "Katz Stealer", "description": "", "modified": "2025-07-07T21:00:15.349000", "created": "2025-06-07T21:14:39.087000", "tags": [ "KatzStealer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Katz Stealer", "display_name": "Katz Stealer", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 125, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 14, "hostname": 43 }, "indicator_count": 314, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "327 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://paste.ee/d/TG5jqZvY/0", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://paste.ee/d/TG5jqZvY/0", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [], "date_added": "2025-06-11", "last_online": "2025-06-11", "reporter": "JAMESWT_WT", "host": "paste.ee", "payloads": [ { "filename": "0", "file_type": "txt", "md5": "48094ce78f9de297cb7f2fad654fafbd", "sha256": "4df9f243aebf172dd529396b2b2f83d07d0a337c298a92dde86c4ff94460f6ac", "signature": null, "first_seen": "2025-06-11" } ], "error": null }, "from_cache": true, "_cached_at": 1780245615.6401906 }