{ "type": "URL", "indicator": "https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg", "type": "url", "type_title": "URL", "validation": [ { "source": "whitelist", "message": "Whitelisted domain githubusercontent.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain githubusercontent.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3991045164, "indicator": "https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "69840cdfbd5f1b5932a62c2a", "name": "geoplugin", "description": "", "modified": "2026-03-07T03:01:37.719000", "created": "2026-02-05T03:22:07.287000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Trojan.Remcos-9841897-0", "display_name": "Win.Trojan.Remcos-9841897-0", "target": null }, { "id": "CastleLoader", "display_name": "CastleLoader", "target": null }, { "id": "Backdoor:Win32/Remcos.GA!MTB", "display_name": "Backdoor:Win32/Remcos.GA!MTB", "target": "/malware/Backdoor:Win32/Remcos.GA!MTB" }, { "id": "Zeppelin_10", "display_name": "Zeppelin_10", "target": null }, { "id": "Win32:DropperX-gen\\ [Drp]", "display_name": "Win32:DropperX-gen\\ [Drp]", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:MSIL/RemcosInjector!MTB", "display_name": "ALF:HeraklezEval:Backdoor:MSIL/RemcosInjector!MTB", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 67, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 124, "domain": 1, "hostname": 2 }, "indicator_count": 238, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "694d91b5652eb90060de728a", "name": "geoplugin", "description": "", "modified": "2026-01-24T11:02:48.120000", "created": "2025-12-25T19:34:13.020000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 178, "FileHash-MD5": 41, "FileHash-SHA1": 37, "FileHash-SHA256": 913, "domain": 11, "hostname": 11 }, "indicator_count": 1191, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "127 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "381 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6709b0aee79c25ff8275d77e", "name": "URLHaus data - 11-10-2024", "description": "", "modified": "2024-11-10T23:02:55.870000", "created": "2024-10-11T23:11:42.041000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "botnetdomain", "gafgyt", "ua-wget", "SocGholish", "downloader", "Lumma", "ps1", "exe", "zip", "CobaltStrike", "32", "apk", "Avastavv.apk", "SpyNote", "NanoCore", "opendir", "ascii", "VIPKeylogger", "jpg-base64-loader", "Encoded", "encrypted", "GuLoader", "Formbook", "js", "xworm", "MassLogger", "LummaStealer", "dll", "Stealc", "stealer", "Password-protected", "Verus", "powershell", "ScrInject", "Metasploit", "healer", "AmosStealer", "dmg" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 10, "hostname": 9 }, "indicator_count": 1019, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.trojan.remcos-9841897-0", "Zeppelin_10", "Win32:dropperx-gen\\ [drp]", "Castleloader", "Alf:heraklezeval:backdoor:msil/remcosinjector!mtb", "Backdoor:win32/remcos.ga!mtb" ], "industries": [], "unique_indicators": 314840 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/githubusercontent.com", "whois": "http://whois.domaintools.com/githubusercontent.com", "domain": "githubusercontent.com", "hostname": "raw.githubusercontent.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "69840cdfbd5f1b5932a62c2a", "name": "geoplugin", "description": "", "modified": "2026-03-07T03:01:37.719000", "created": "2026-02-05T03:22:07.287000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Trojan.Remcos-9841897-0", "display_name": "Win.Trojan.Remcos-9841897-0", "target": null }, { "id": "CastleLoader", "display_name": "CastleLoader", "target": null }, { "id": "Backdoor:Win32/Remcos.GA!MTB", "display_name": "Backdoor:Win32/Remcos.GA!MTB", "target": "/malware/Backdoor:Win32/Remcos.GA!MTB" }, { "id": "Zeppelin_10", "display_name": "Zeppelin_10", "target": null }, { "id": "Win32:DropperX-gen\\ [Drp]", "display_name": "Win32:DropperX-gen\\ [Drp]", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:MSIL/RemcosInjector!MTB", "display_name": "ALF:HeraklezEval:Backdoor:MSIL/RemcosInjector!MTB", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 67, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 124, "domain": 1, "hostname": 2 }, "indicator_count": 238, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "694d91b5652eb90060de728a", "name": "geoplugin", "description": "", "modified": "2026-01-24T11:02:48.120000", "created": "2025-12-25T19:34:13.020000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 178, "FileHash-MD5": 41, "FileHash-SHA1": 37, "FileHash-SHA256": 913, "domain": 11, "hostname": 11 }, "indicator_count": 1191, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "127 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "381 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6709b0aee79c25ff8275d77e", "name": "URLHaus data - 11-10-2024", "description": "", "modified": "2024-11-10T23:02:55.870000", "created": "2024-10-11T23:11:42.041000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "botnetdomain", "gafgyt", "ua-wget", "SocGholish", "downloader", "Lumma", "ps1", "exe", "zip", "CobaltStrike", "32", "apk", "Avastavv.apk", "SpyNote", "NanoCore", "opendir", "ascii", "VIPKeylogger", "jpg-base64-loader", "Encoded", "encrypted", "GuLoader", "Formbook", "js", "xworm", "MassLogger", "LummaStealer", "dll", "Stealc", "stealer", "Password-protected", "Verus", "powershell", "ScrInject", "Metasploit", "healer", "AmosStealer", "dmg" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 10, "hostname": 9 }, "indicator_count": 1019, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "jpg-base64-loader", "VIPKeylogger" ], "date_added": "2024-10-11", "last_online": "2024-10-17", "reporter": "abuse_ch", "host": "raw.githubusercontent.com", "payloads": [ { "filename": null, "file_type": "jpg", "md5": "50b0b3c96b20967cb16560b185094563", "sha256": "007e8bc23ec13a3a1ae1e21ffd70c9206a89f6379b0f3f1cbfe8626dac288539", "signature": null, "first_seen": "2024-10-11" } ], "error": null }, "from_cache": true, "_cached_at": 1780266504.5187223 }