{ "type": "URL", "indicator": "https://py-installer.cc/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://py-installer.cc/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4163032076, "indicator": "https://py-installer.cc/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "69af9fbf9965db26705f2930", "name": "URLHaus data - 09-03-2026 (Part 2)", "description": "", "modified": "2026-04-09T04:21:15.538000", "created": "2026-03-10T04:36:15.569000", "tags": [ "ClearFake", "elf", "geofenced", "mips", "mirai", "opendir", "ua-wget", "USA", "arm", "x86", "sparc", "SuperH", "PowerPC", "m68k", "sh", "32-bit", "Mozi", "dropped-by-Phorpiex", "dropped-by-amadey", "fbf543", "SalatStealer", "c2-monitor-auto", "Amadey", "VIPKeylogger", "Vidar", "connectwise", "AmateraStealer", "pw-cyrex", "zip", "EternalRocks", "Smoke Loader", "RemcosRAT", "encrypted", "GuLoader", "MassLogger", "QuasarRAT", "CoinMiner", "CVE-2026-1731", "ua-curl", "ascii", "bash", "BRAT", "exe", "pw-2201", "rar", "CountLoader", "ua-mshta", "SmartLoader", "SilverFox", "pw-valorant_git", "LummaStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 54, "URL": 283, "domain": 11 }, "indicator_count": 348, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69afb2eea65a51c86d5783ad", "name": "CyberHunterAutoFeed Public TLP: Greenclone", "description": "", "modified": "2026-04-09T04:21:15.538000", "created": "2026-03-10T05:58:06.988000", "tags": [ "ClearFake", "elf", "geofenced", "mips", "mirai", "opendir", "ua-wget", "USA", "arm", "x86", "sparc", "SuperH", "PowerPC", "m68k", "sh", "32-bit", "Mozi", "dropped-by-Phorpiex", "dropped-by-amadey", "fbf543", "SalatStealer", "c2-monitor-auto", "Amadey", "VIPKeylogger", "Vidar", "connectwise", "AmateraStealer", "pw-cyrex", "zip", "EternalRocks", "Smoke Loader", "RemcosRAT", "encrypted", "GuLoader", "MassLogger", "QuasarRAT", "CoinMiner", "CVE-2026-1731", "ua-curl", "ascii", "bash", "BRAT", "exe", "pw-2201", "rar", "CountLoader", "ua-mshta", "SmartLoader", "SilverFox", "pw-valorant_git", "LummaStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69af9fbf9965db26705f2930", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 54, "URL": 283, "domain": 11 }, "indicator_count": 348, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "694bde495c4f1023c4a3c1ab", "name": "EbeeDec2025 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-01-23T12:00:04.403000", "created": "2025-12-24T12:36:25.036000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara", "name" ], "references": [ "Book2.csv" ], "public": 1, "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 159, "FileHash-SHA256": 165, "CVE": 5, "URL": 86, "domain": 146, "email": 10, "hostname": 40 }, "indicator_count": 760, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "127 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6942fb0ce613e0d9555839bf", "name": "EbeeDec2025 Pt4", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-01-16T18:05:42.447000", "created": "2025-12-17T18:48:44.660000", "tags": [ "filehashmd5", "filehashsha256", "filehashsha1" ], "references": [ "Book2.csv" ], "public": 1, "adversary": "Ashen Lepus, Campaign to deliver Python based Malware, ConsentFix, Luca Stealer, Makop ransomware", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 61, "CVE": 4, "FileHash-MD5": 174, "FileHash-SHA1": 154, "FileHash-SHA256": 166, "domain": 96, "hostname": 25 }, "indicator_count": 680, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "134 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6940f24d0c89f7038da6bd25", "name": "PyStoreRAT GitHub Campaign Delivering a Modular HTA JavaScript RAT", "description": "", "modified": "2026-01-15T05:01:58.756000", "created": "2025-12-16T05:46:53.406000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MohammedRizwan2001", "id": "361933", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "domain": 3, "hostname": 1 }, "indicator_count": 9, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "Book2.csv" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Ashen Lepus, Campaign to deliver Python based Malware, ConsentFix, Luca Stealer, Makop ransomware", "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing" ], "malware_families": [], "industries": [], "unique_indicators": 1977 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/py-installer.cc", "whois": "http://whois.domaintools.com/py-installer.cc", "domain": "py-installer.cc", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "69af9fbf9965db26705f2930", "name": "URLHaus data - 09-03-2026 (Part 2)", "description": "", "modified": "2026-04-09T04:21:15.538000", "created": "2026-03-10T04:36:15.569000", "tags": [ "ClearFake", "elf", "geofenced", "mips", "mirai", "opendir", "ua-wget", "USA", "arm", "x86", "sparc", "SuperH", "PowerPC", "m68k", "sh", "32-bit", "Mozi", "dropped-by-Phorpiex", "dropped-by-amadey", "fbf543", "SalatStealer", "c2-monitor-auto", "Amadey", "VIPKeylogger", "Vidar", "connectwise", "AmateraStealer", "pw-cyrex", "zip", "EternalRocks", "Smoke Loader", "RemcosRAT", "encrypted", "GuLoader", "MassLogger", "QuasarRAT", "CoinMiner", "CVE-2026-1731", "ua-curl", "ascii", "bash", "BRAT", "exe", "pw-2201", "rar", "CountLoader", "ua-mshta", "SmartLoader", "SilverFox", "pw-valorant_git", "LummaStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 54, "URL": 283, "domain": 11 }, "indicator_count": 348, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69afb2eea65a51c86d5783ad", "name": "CyberHunterAutoFeed Public TLP: Greenclone", "description": "", "modified": "2026-04-09T04:21:15.538000", "created": "2026-03-10T05:58:06.988000", "tags": [ "ClearFake", "elf", "geofenced", "mips", "mirai", "opendir", "ua-wget", "USA", "arm", "x86", "sparc", "SuperH", "PowerPC", "m68k", "sh", "32-bit", "Mozi", "dropped-by-Phorpiex", "dropped-by-amadey", "fbf543", "SalatStealer", "c2-monitor-auto", "Amadey", "VIPKeylogger", "Vidar", "connectwise", "AmateraStealer", "pw-cyrex", "zip", "EternalRocks", "Smoke Loader", "RemcosRAT", "encrypted", "GuLoader", "MassLogger", "QuasarRAT", "CoinMiner", "CVE-2026-1731", "ua-curl", "ascii", "bash", "BRAT", "exe", "pw-2201", "rar", "CountLoader", "ua-mshta", "SmartLoader", "SilverFox", "pw-valorant_git", "LummaStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69af9fbf9965db26705f2930", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 54, "URL": 283, "domain": 11 }, "indicator_count": 348, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "694bde495c4f1023c4a3c1ab", "name": "EbeeDec2025 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-01-23T12:00:04.403000", "created": "2025-12-24T12:36:25.036000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara", "name" ], "references": [ "Book2.csv" ], "public": 1, "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 159, "FileHash-SHA256": 165, "CVE": 5, "URL": 86, "domain": 146, "email": 10, "hostname": 40 }, "indicator_count": 760, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "127 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6942fb0ce613e0d9555839bf", "name": "EbeeDec2025 Pt4", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-01-16T18:05:42.447000", "created": "2025-12-17T18:48:44.660000", "tags": [ "filehashmd5", "filehashsha256", "filehashsha1" ], "references": [ "Book2.csv" ], "public": 1, "adversary": "Ashen Lepus, Campaign to deliver Python based Malware, ConsentFix, Luca Stealer, Makop ransomware", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 61, "CVE": 4, "FileHash-MD5": 174, "FileHash-SHA1": 154, "FileHash-SHA256": 166, "domain": 96, "hostname": 25 }, "indicator_count": 680, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "134 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6940f24d0c89f7038da6bd25", "name": "PyStoreRAT GitHub Campaign Delivering a Modular HTA JavaScript RAT", "description": "", "modified": "2026-01-15T05:01:58.756000", "created": "2025-12-16T05:46:53.406000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MohammedRizwan2001", "id": "361933", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "domain": 3, "hostname": 1 }, "indicator_count": 9, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://py-installer.cc/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://py-installer.cc/", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "CountLoader", "ua-mshta" ], "date_added": "2026-03-09", "last_online": "2026-03-09", "reporter": "abuse_ch", "host": "py-installer.cc", "payloads": [ { "filename": "Invoice_Beta_v4.8.jpg", "file_type": "hta", "md5": "c5083ca592e8452b99e6ac86c8a19659", "sha256": "06a3c6c95e739430812dddcdf09d93dcc3368bbd583cad0e0d6cd3428a2ae43e", "signature": "CountLoader", "first_seen": "2026-03-09" } ], "error": null }, "from_cache": true, "_cached_at": 1780223994.5985134 }