{ "type": "URL", "indicator": "https://rbmlh.xyz/lakd", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://rbmlh.xyz/lakd", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4081716216, "indicator": "https://rbmlh.xyz/lakd", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6864efcb81d95c2526823c64", "name": "check later", "description": "", "modified": "2026-02-09T14:37:34.380000", "created": "2025-07-02T08:37:31.986000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 55, "FileHash-SHA1": 57, "FileHash-SHA256": 241, "URL": 191, "hostname": 17, "domain": 103 }, "indicator_count": 664, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "112 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6869bdc7e56970f9124b8e3b", "name": "Amadey", "description": "", "modified": "2026-02-01T17:54:06.733000", "created": "2025-07-06T00:05:27.184000", "tags": [ "Amadey" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 64, "URL": 230, "FileHash-MD5": 61, "FileHash-SHA1": 62, "FileHash-SHA256": 245, "hostname": 12 }, "indicator_count": 674, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6886612cf576c9970af29643", "name": "njrat", "description": "", "modified": "2026-01-15T23:38:41.564000", "created": "2025-07-27T17:26:04.907000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 23, "URL": 304, "FileHash-MD5": 46, "FileHash-SHA1": 47, "FileHash-SHA256": 164, "hostname": 16 }, "indicator_count": 600, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6878fa76ef0fc60c55547527", "name": "ipwhois", "description": "", "modified": "2025-12-19T23:39:48.219000", "created": "2025-07-17T13:28:22.909000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 216, "FileHash-MD5": 73, "FileHash-SHA1": 76, "FileHash-SHA256": 395, "domain": 23, "hostname": 21 }, "indicator_count": 804, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "163 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "686dd9191dec759cf53a562c", "name": "one more", "description": "", "modified": "2025-12-15T02:09:44.084000", "created": "2025-07-09T02:51:05.143000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 35, "hostname": 48, "URL": 211, "FileHash-MD5": 28, "FileHash-SHA1": 30, "FileHash-SHA256": 120 }, "indicator_count": 472, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "168 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "686a1f2dab47342691c71bec", "name": "Lumma Stealer attacking Telegram (t.me) & Dropbox", "description": "Lumma Stealer, CNC, critical multiple malware IoC\u2019s attack. Telegram, remote Dropbox stealing among multiple targeted attacks. Dropbox spyware. \nNitrogen ransomware present.\n#apple_webkit #chrome #steam #lumma #ransom #stealer", "modified": "2025-08-05T06:03:08.761000", "created": "2025-07-06T07:01:01.459000", "tags": [ "server response", "petya", "ransom", "lumma", "rozena", "dynamicloader", "domain", "dns lookup", "related cnc", "et malware", "medium", "search", "tls sni", "stealer related", "show", "write", "win64", "suspicious", "wave", "unknown", "malware", "path", "desktop", "copy", "next", "nitrogen", "snake", "learn", "command", "ck id", "name tactics", "informative", "spawns", "found", "defense evasion", "t1480 execution", "united", "flag", "server", "date", "contacted hosts", "ip address", "process details", "austria austria", "show technique", "mitre att", "ck matrix", "pattern match", "ascii text", "show process", "network traffic", "utf8", "crlf line", "general", "local", "present jul", "aaaa", "virgin islands", "antigua", "status", "org domains", "proxy", "code", "present apr", "date checked", "url hostname", "server response", "google safe", "results apr", "files show", "date hash", "avast avg", "msil", "trojandropper", "themida jun", "win32", "entries", "passive dns", "urls", "files", "barbuda asn", "multiple attacks", "tls handshake", "failure", "high", "windows", "dropbox", "telegram", "connections dropped", "a domains", "servers", "certificate", "moved", "dropbox", "lutimanisdk", "trojan", "body", "present jun", "error", "bad traffic", "redirects", "creation date", "showing", "next associated", "spyware", "link", "meta", "script", "gmt contenttype", "lowfi", "hookwowlow jun", "a li", "ul div", "dropbox plus", "div div", "span span", "erreur", "span", "window", "adobe systems", "stock photos", "adobe stock", "photos cs3", "yara detections", "april", "synapse", "installer", "apple", "steam community", "apple webkit", "dropbox 4xx" ], "references": [ "146.112.61.107 (146.112.48.0/20) AS 36692 ( CISCO UMBRELLA ) US", "IDS Detections: Win32/Lumma Stealer Related \u2022 CnC Domain in DNS Lookup (pacwpw .xyz)", "Lumma Stealer CNC {FILEHASH SHA256 bc9c5c8dfdcf0d2a321478207b0870274fba25b93075fc987768623237973646} t.me / Dropbox", "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (comkxjs .xyz) (unurew .xyz) (trsuv .xyz)", "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sqgzl .xyz) (cexpxg .xyz) (cexpxg .xyz) (urarfx .xyz)", "Win.Exploit.Rozena {FileHash-SHA256 21fb4fdce85ab75430e18d9362a35f61dcaeb628c28836403472c054d6ceab8c}", "Lumma Stealer https://t.me/pizdenka202020 / t.me", "Query to a *.top domain - Likely Hostile\t192.168.122.95\t1.1.1.1\t\t\t\t SHOWING 1 TO 22 OF 22 ENTRIES HTTP Request Get 1 Post 2 Put 0 Delete 0 URL HOST PORT METHOD USER AGENT https://steamcommunity.com/profiles/76561199863199067\tsteamcommunity.com\t443\tGET\tN/A { \"src\": \"192.168.122.95\", \"sport\": 49227, \"dst\": \"23.59.52.127\", \"dport\":, \"protocol\": \"https\", \"method\": \"GET\", \"host\": \"steamcommunity.com\", \"uri\": \"/profiles/76561199863199067\", \"status\": 200, \"request\": \"GET /profiles/7656119986319", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36", "(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 30038 Host: accsrf.top" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Exploit.Rozena", "display_name": "Win.Exploit.Rozena", "target": null }, { "id": "ALF:Ransom:Win32/Petya.SIB!MTB", "display_name": "ALF:Ransom:Win32/Petya.SIB!MTB", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "Nitrogen Loader", "display_name": "Nitrogen Loader", "target": null }, { "id": "Nitrogen Ransomware", "display_name": "Nitrogen Ransomware", "target": null }, { "id": "Themida.", "display_name": "Themida.", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1036.003", "name": "Rename System Utilities", "display_name": "T1036.003 - Rename System Utilities" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1011", "name": "Exfiltration Over Other Network Medium", "display_name": "T1011 - Exfiltration Over Other Network Medium" }, { "id": "T1590.002", "name": "DNS", "display_name": "T1590.002 - DNS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [ "Telecommunications", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 130, "FileHash-SHA1": 110, "FileHash-SHA256": 119, "URL": 237, "domain": 64, "SSLCertFingerprint": 5, "hostname": 63, "email": 2 }, "indicator_count": 730, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "300 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (comkxjs .xyz) (unurew .xyz) (trsuv .xyz)", "146.112.61.107 (146.112.48.0/20) AS 36692 ( CISCO UMBRELLA ) US", "Query to a *.top domain - Likely Hostile\t192.168.122.95\t1.1.1.1\t\t\t\t SHOWING 1 TO 22 OF 22 ENTRIES HTTP Request Get 1 Post 2 Put 0 Delete 0 URL HOST PORT METHOD USER AGENT https://steamcommunity.com/profiles/76561199863199067\tsteamcommunity.com\t443\tGET\tN/A { \"src\": \"192.168.122.95\", \"sport\": 49227, \"dst\": \"23.59.52.127\", \"dport\":, \"protocol\": \"https\", \"method\": \"GET\", \"host\": \"steamcommunity.com\", \"uri\": \"/profiles/76561199863199067\", \"status\": 200, \"request\": \"GET /profiles/7656119986319", "IDS Detections: Win32/Lumma Stealer Related \u2022 CnC Domain in DNS Lookup (pacwpw .xyz)", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36", "Lumma Stealer https://t.me/pizdenka202020 / t.me", "(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 30038 Host: accsrf.top", "Win.Exploit.Rozena {FileHash-SHA256 21fb4fdce85ab75430e18d9362a35f61dcaeb628c28836403472c054d6ceab8c}", "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sqgzl .xyz) (cexpxg .xyz) (cexpxg .xyz) (urarfx .xyz)", "Lumma Stealer CNC {FILEHASH SHA256 bc9c5c8dfdcf0d2a321478207b0870274fba25b93075fc987768623237973646} t.me / Dropbox" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Alf:ransom:win32/petya.sib!mtb", "Win.exploit.rozena", "Lumma stealer", "Nitrogen loader", "Nitrogen ransomware", "Themida." ], "industries": [ "Telecommunications", "Technology" ], "unique_indicators": 3668 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/rbmlh.xyz", "whois": "http://whois.domaintools.com/rbmlh.xyz", "domain": "rbmlh.xyz", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6864efcb81d95c2526823c64", "name": "check later", "description": "", "modified": "2026-02-09T14:37:34.380000", "created": "2025-07-02T08:37:31.986000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 55, "FileHash-SHA1": 57, "FileHash-SHA256": 241, "URL": 191, "hostname": 17, "domain": 103 }, "indicator_count": 664, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "112 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6869bdc7e56970f9124b8e3b", "name": "Amadey", "description": "", "modified": "2026-02-01T17:54:06.733000", "created": "2025-07-06T00:05:27.184000", "tags": [ "Amadey" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 64, "URL": 230, "FileHash-MD5": 61, "FileHash-SHA1": 62, "FileHash-SHA256": 245, "hostname": 12 }, "indicator_count": 674, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6886612cf576c9970af29643", "name": "njrat", "description": "", "modified": "2026-01-15T23:38:41.564000", "created": "2025-07-27T17:26:04.907000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 23, "URL": 304, "FileHash-MD5": 46, "FileHash-SHA1": 47, "FileHash-SHA256": 164, "hostname": 16 }, "indicator_count": 600, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6878fa76ef0fc60c55547527", "name": "ipwhois", "description": "", "modified": "2025-12-19T23:39:48.219000", "created": "2025-07-17T13:28:22.909000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 216, "FileHash-MD5": 73, "FileHash-SHA1": 76, "FileHash-SHA256": 395, "domain": 23, "hostname": 21 }, "indicator_count": 804, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "163 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "686dd9191dec759cf53a562c", "name": "one more", "description": "", "modified": "2025-12-15T02:09:44.084000", "created": "2025-07-09T02:51:05.143000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 35, "hostname": 48, "URL": 211, "FileHash-MD5": 28, "FileHash-SHA1": 30, "FileHash-SHA256": 120 }, "indicator_count": 472, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "168 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "686a1f2dab47342691c71bec", "name": "Lumma Stealer attacking Telegram (t.me) & Dropbox", "description": "Lumma Stealer, CNC, critical multiple malware IoC\u2019s attack. Telegram, remote Dropbox stealing among multiple targeted attacks. Dropbox spyware. \nNitrogen ransomware present.\n#apple_webkit #chrome #steam #lumma #ransom #stealer", "modified": "2025-08-05T06:03:08.761000", "created": "2025-07-06T07:01:01.459000", "tags": [ "server response", "petya", "ransom", "lumma", "rozena", "dynamicloader", "domain", "dns lookup", "related cnc", "et malware", "medium", "search", "tls sni", "stealer related", "show", "write", "win64", "suspicious", "wave", "unknown", "malware", "path", "desktop", "copy", "next", "nitrogen", "snake", "learn", "command", "ck id", "name tactics", "informative", "spawns", "found", "defense evasion", "t1480 execution", "united", "flag", "server", "date", "contacted hosts", "ip address", "process details", "austria austria", "show technique", "mitre att", "ck matrix", "pattern match", "ascii text", "show process", "network traffic", "utf8", "crlf line", "general", "local", "present jul", "aaaa", "virgin islands", "antigua", "status", "org domains", "proxy", "code", "present apr", "date checked", "url hostname", "server response", "google safe", "results apr", "files show", "date hash", "avast avg", "msil", "trojandropper", "themida jun", "win32", "entries", "passive dns", "urls", "files", "barbuda asn", "multiple attacks", "tls handshake", "failure", "high", "windows", "dropbox", "telegram", "connections dropped", "a domains", "servers", "certificate", "moved", "dropbox", "lutimanisdk", "trojan", "body", "present jun", "error", "bad traffic", "redirects", "creation date", "showing", "next associated", "spyware", "link", "meta", "script", "gmt contenttype", "lowfi", "hookwowlow jun", "a li", "ul div", "dropbox plus", "div div", "span span", "erreur", "span", "window", "adobe systems", "stock photos", "adobe stock", "photos cs3", "yara detections", "april", "synapse", "installer", "apple", "steam community", "apple webkit", "dropbox 4xx" ], "references": [ "146.112.61.107 (146.112.48.0/20) AS 36692 ( CISCO UMBRELLA ) US", "IDS Detections: Win32/Lumma Stealer Related \u2022 CnC Domain in DNS Lookup (pacwpw .xyz)", "Lumma Stealer CNC {FILEHASH SHA256 bc9c5c8dfdcf0d2a321478207b0870274fba25b93075fc987768623237973646} t.me / Dropbox", "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (comkxjs .xyz) (unurew .xyz) (trsuv .xyz)", "Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sqgzl .xyz) (cexpxg .xyz) (cexpxg .xyz) (urarfx .xyz)", "Win.Exploit.Rozena {FileHash-SHA256 21fb4fdce85ab75430e18d9362a35f61dcaeb628c28836403472c054d6ceab8c}", "Lumma Stealer https://t.me/pizdenka202020 / t.me", "Query to a *.top domain - Likely Hostile\t192.168.122.95\t1.1.1.1\t\t\t\t SHOWING 1 TO 22 OF 22 ENTRIES HTTP Request Get 1 Post 2 Put 0 Delete 0 URL HOST PORT METHOD USER AGENT https://steamcommunity.com/profiles/76561199863199067\tsteamcommunity.com\t443\tGET\tN/A { \"src\": \"192.168.122.95\", \"sport\": 49227, \"dst\": \"23.59.52.127\", \"dport\":, \"protocol\": \"https\", \"method\": \"GET\", \"host\": \"steamcommunity.com\", \"uri\": \"/profiles/76561199863199067\", \"status\": 200, \"request\": \"GET /profiles/7656119986319", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36", "(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 30038 Host: accsrf.top" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Exploit.Rozena", "display_name": "Win.Exploit.Rozena", "target": null }, { "id": "ALF:Ransom:Win32/Petya.SIB!MTB", "display_name": "ALF:Ransom:Win32/Petya.SIB!MTB", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "Nitrogen Loader", "display_name": "Nitrogen Loader", "target": null }, { "id": "Nitrogen Ransomware", "display_name": "Nitrogen Ransomware", "target": null }, { "id": "Themida.", "display_name": "Themida.", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1036.003", "name": "Rename System Utilities", "display_name": "T1036.003 - Rename System Utilities" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1011", "name": "Exfiltration Over Other Network Medium", "display_name": "T1011 - Exfiltration Over Other Network Medium" }, { "id": "T1590.002", "name": "DNS", "display_name": "T1590.002 - DNS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [ "Telecommunications", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 130, "FileHash-SHA1": 110, "FileHash-SHA256": 119, "URL": 237, "domain": 64, "SSLCertFingerprint": 5, "hostname": 63, "email": 2 }, "indicator_count": 730, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "300 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://rbmlh.xyz/lakd", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://rbmlh.xyz/lakd", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780355455.7301886 }