{ "type": "URL", "indicator": "https://subinfralab.info/hgAdDiLmnB", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://subinfralab.info/hgAdDiLmnB", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3654667237, "indicator": "https://subinfralab.info/hgAdDiLmnB", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 20, "pulses": [ { "id": "68650dc72066f12ec3d51939", "name": "Iranian APT Actors-Pt4", "description": "", "modified": "2025-08-01T10:03:06.225000", "created": "2025-07-02T10:45:25.998000", "tags": [], "references": [ "IOCs.pdf" ], "public": 1, "adversary": "Agrius, Cuboid Sandstorm, Tortoiseshell, Gray Sandstorm, Pumpkin Sandstorm, Lemon Sandstorm, BladedF", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 15, "FileHash-MD5": 92, "FileHash-SHA1": 100, "FileHash-SHA256": 124, "CVE": 13, "domain": 157, "email": 2, "hostname": 8 }, "indicator_count": 511, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "303 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a1e31eda9b131962779", "name": "InQuest - 04-05-2023", "description": "", "modified": "2023-12-06T15:58:22.072000", "created": "2023-12-06T15:58:22.072000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 469, "URL": 1770, "hostname": 821, "domain": 718, "FileHash-MD5": 78, "FileHash-SHA1": 69 }, "indicator_count": 3925, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a1560115cb73927eaa1", "name": "InQuest - 03-05-2023", "description": "", "modified": "2023-12-06T15:58:13.968000", "created": "2023-12-06T15:58:13.968000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 454, "URL": 1797, "hostname": 843, "domain": 724, "FileHash-MD5": 55, "FileHash-SHA1": 69 }, "indicator_count": 3942, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a095facfe58fcad4bd0", "name": "InQuest - 02-05-2023", "description": "", "modified": "2023-12-06T15:58:01.458000", "created": "2023-12-06T15:58:01.458000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 419, "URL": 1822, "hostname": 891, "domain": 701, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3929, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a04b18f314c64abf0c8", "name": "InQuest - 01-05-2023", "description": "", "modified": "2023-12-06T15:57:56.775000", "created": "2023-12-06T15:57:56.775000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 419, "URL": 1829, "hostname": 899, "domain": 701, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3944, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099ea0b8537116278bcd0", "name": "InQuest - 30-04-2023", "description": "", "modified": "2023-12-06T15:57:30.763000", "created": "2023-12-06T15:57:30.763000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 399, "URL": 1842, "hostname": 919, "domain": 694, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099e050d6f13c0fe4bf5d", "name": "InQuest - 29-04-2023", "description": "", "modified": "2023-12-06T15:57:20.556000", "created": "2023-12-06T15:57:20.556000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 399, "URL": 1842, "hostname": 919, "domain": 694, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64543de5371b85332405dc01", "name": "InQuest - 04-05-2023", "description": "", "modified": "2023-05-04T23:21:09.455000", "created": "2023-05-04T23:21:09.455000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 469, "domain": 718, "URL": 1770, "FileHash-MD5": 78, "hostname": 821, "IPv4": 75, "FileHash-SHA1": 69 }, "indicator_count": 4000, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1123 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6452ec4398064bbe35f12ffa", "name": "InQuest - 03-05-2023", "description": "", "modified": "2023-05-03T23:20:35.475000", "created": "2023-05-03T23:20:35.475000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 724, "URL": 1797, "FileHash-SHA1": 69, "IPv4": 73, "FileHash-SHA256": 454, "hostname": 843, "FileHash-MD5": 55 }, "indicator_count": 4015, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1124 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64519b5f16e353d4bebbbdd9", "name": "InQuest - 02-05-2023", "description": "", "modified": "2023-05-02T23:23:11.858000", "created": "2023-05-02T23:23:11.858000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 701, "URL": 1822, "hostname": 891, "FileHash-SHA256": 419, "FileHash-MD5": 55, "IPv4": 72, "FileHash-SHA1": 41 }, "indicator_count": 4001, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1125 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645048e2231cba9be9c8d5c2", "name": "InQuest - 01-05-2023", "description": "", "modified": "2023-05-01T23:18:58.420000", "created": "2023-05-01T23:18:58.420000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 701, "URL": 1829, "hostname": 899, "FileHash-SHA256": 419, "FileHash-MD5": 55, "IPv4": 72, "FileHash-SHA1": 41 }, "indicator_count": 4016, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1126 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "644ef75b3a875ec8d5e5065e", "name": "InQuest - 30-04-2023", "description": "", "modified": "2023-04-30T23:18:51.673000", "created": "2023-04-30T23:18:51.673000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 919, "URL": 1842, "FileHash-SHA256": 399, "FileHash-MD5": 55, "IPv4": 74, "domain": 694, "FileHash-SHA1": 41 }, "indicator_count": 4024, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1127 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "644da5e57d7d32f3177b9871", "name": "InQuest - 29-04-2023", "description": "", "modified": "2023-04-29T23:19:01.733000", "created": "2023-04-29T23:19:01.733000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 919, "URL": 1842, "FileHash-SHA256": 399, "FileHash-MD5": 55, "IPv4": 74, "domain": 694, "FileHash-SHA1": 41 }, "indicator_count": 4024, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1128 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "644b03abf6537892ff63a718", "name": "InQuest - 27-04-2023", "description": "", "modified": "2023-04-27T23:22:17.833000", "created": "2023-04-27T23:22:17.833000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 979, "URL": 1905, "FileHash-SHA256": 217, "FileHash-MD5": 54, "IPv4": 62, "domain": 712, "FileHash-SHA1": 42 }, "indicator_count": 3971, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1130 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "644a0bdee9f07751cc9b6374", "name": " Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools", "description": "", "modified": "2023-04-27T05:45:02.321000", "created": "2023-04-27T05:45:02.321000", "tags": [ "nemesis kitten", "powerless", "agentfinal.exe", "c server", "phosphorus", "iso file", "command", "lnk file", "byte", "bbjunkcount", "manticore", "check point", "virustotal", "loader", "false", "assembly", "downloader", "explorer", "info", "ransomware" ], "references": [ "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/" ], "public": 1, "adversary": "Nemesis Kitten", "targeted_countries": [ "Israel", "Iraq" ], "malware_families": [ { "id": "AgentFinal.exe", "display_name": "AgentFinal.exe", "target": null }, { "id": "PowerLess", "display_name": "PowerLess", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": "6449f929787cc41683727587", "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 11, "URL": 4, "domain": 3, "hostname": 1 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "1130 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6449f929787cc41683727587", "name": "Educated Manticore - Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools - Check Point Research", "description": "", "modified": "2023-04-27T04:25:13.222000", "created": "2023-04-27T04:25:13.222000", "tags": [ "nemesis kitten", "powerless", "agentfinal.exe", "c server", "phosphorus", "iso file", "command", "lnk file", "byte", "bbjunkcount", "manticore", "check point", "virustotal", "loader", "false", "assembly", "downloader", "explorer", "info", "ransomware" ], "references": [ "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/" ], "public": 1, "adversary": "Nemesis Kitten", "targeted_countries": [ "Israel", "Iraq" ], "malware_families": [ { "id": "AgentFinal.exe", "display_name": "AgentFinal.exe", "target": null }, { "id": "PowerLess", "display_name": "PowerLess", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": "6448e42c0b96879d263cac4d", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 11, "URL": 4, "domain": 3, "hostname": 1 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 187, "modified_text": "1130 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6449b1f3523698c1219d730e", "name": "InQuest - 26-04-2023", "description": "", "modified": "2023-04-26T23:21:23.657000", "created": "2023-04-26T23:21:23.657000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 987, "URL": 1906, "IPv4": 54, "FileHash-SHA256": 205, "FileHash-MD5": 45, "domain": 713, "FileHash-SHA1": 42 }, "indicator_count": 3952, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6448e42c0b96879d263cac4d", "name": "Educated Manticore - Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools - Check Point Research", "description": "Check Point Research\u2019s latest report on Educated Manticore, an Iranian-aligned threat actor targeting Israel, reveals a new and improved infection chain, including an updated version of Implant PowerLess.", "modified": "2023-04-26T08:43:24.136000", "created": "2023-04-26T08:43:24.136000", "tags": [ "nemesis kitten", "powerless", "agentfinal.exe", "c server", "phosphorus", "iso file", "command", "lnk file", "byte", "bbjunkcount", "manticore", "check point", "virustotal", "loader", "false", "assembly", "downloader", "explorer", "info", "ransomware" ], "references": [ "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/" ], "public": 1, "adversary": "Nemesis Kitten", "targeted_countries": [ "Israel", "Iraq" ], "malware_families": [ { "id": "AgentFinal.exe", "display_name": "AgentFinal.exe", "target": null }, { "id": "PowerLess", "display_name": "PowerLess", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 11, "URL": 4, "domain": 3, "hostname": 1 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64487990d003cadc70141949", "name": "Educated Manticore - Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools - Check Point Research", "description": "", "modified": "2023-04-26T01:08:32.241000", "created": "2023-04-26T01:08:32.241000", "tags": [ "c server", "powerless", "phosphorus", "iso file", "command", "lnk file", "byte", "bbjunkcount", "manticore", "check point", "virustotal", "loader", "false", "assembly", "downloader", "explorer", "info", "ransomware" ], "references": [ "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "s2wlab_talon", "id": "125133", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 11, "URL": 4, "domain": 3, "hostname": 1 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64485ff7dbe981c89fa08dd0", "name": "InQuest - 25-04-2023", "description": "", "modified": "2023-04-25T23:19:19.304000", "created": "2023-04-25T23:19:19.304000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 54, "FileHash-SHA256": 205, "FileHash-MD5": 45, "hostname": 986, "URL": 1905, "domain": 713, "FileHash-SHA1": 42 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "IOCs.pdf", "https://labs.inquest.net/iocdb", "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Agrius, Cuboid Sandstorm, Tortoiseshell, Gray Sandstorm, Pumpkin Sandstorm, Lemon Sandstorm, BladedF", "Nemesis Kitten" ], "malware_families": [ "Agentfinal.exe", "Powerless" ], "industries": [], "unique_indicators": 5155 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/subinfralab.info", "whois": "http://whois.domaintools.com/subinfralab.info", "domain": "subinfralab.info", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 20, "pulses": [ { "id": "68650dc72066f12ec3d51939", "name": "Iranian APT Actors-Pt4", "description": "", "modified": "2025-08-01T10:03:06.225000", "created": "2025-07-02T10:45:25.998000", "tags": [], "references": [ "IOCs.pdf" ], "public": 1, "adversary": "Agrius, Cuboid Sandstorm, Tortoiseshell, Gray Sandstorm, Pumpkin Sandstorm, Lemon Sandstorm, BladedF", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 15, "FileHash-MD5": 92, "FileHash-SHA1": 100, "FileHash-SHA256": 124, "CVE": 13, "domain": 157, "email": 2, "hostname": 8 }, "indicator_count": 511, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "303 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a1e31eda9b131962779", "name": "InQuest - 04-05-2023", "description": "", "modified": "2023-12-06T15:58:22.072000", "created": "2023-12-06T15:58:22.072000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 469, "URL": 1770, "hostname": 821, "domain": 718, "FileHash-MD5": 78, "FileHash-SHA1": 69 }, "indicator_count": 3925, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a1560115cb73927eaa1", "name": "InQuest - 03-05-2023", "description": "", "modified": "2023-12-06T15:58:13.968000", "created": "2023-12-06T15:58:13.968000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 454, "URL": 1797, "hostname": 843, "domain": 724, "FileHash-MD5": 55, "FileHash-SHA1": 69 }, "indicator_count": 3942, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a095facfe58fcad4bd0", "name": "InQuest - 02-05-2023", "description": "", "modified": "2023-12-06T15:58:01.458000", "created": "2023-12-06T15:58:01.458000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 419, "URL": 1822, "hostname": 891, "domain": 701, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3929, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a04b18f314c64abf0c8", "name": "InQuest - 01-05-2023", "description": "", "modified": "2023-12-06T15:57:56.775000", "created": "2023-12-06T15:57:56.775000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 419, "URL": 1829, "hostname": 899, "domain": 701, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3944, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099ea0b8537116278bcd0", "name": "InQuest - 30-04-2023", "description": "", "modified": "2023-12-06T15:57:30.763000", "created": "2023-12-06T15:57:30.763000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 399, "URL": 1842, "hostname": 919, "domain": 694, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099e050d6f13c0fe4bf5d", "name": "InQuest - 29-04-2023", "description": "", "modified": "2023-12-06T15:57:20.556000", "created": "2023-12-06T15:57:20.556000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 399, "URL": 1842, "hostname": 919, "domain": 694, "FileHash-MD5": 55, "FileHash-SHA1": 41 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64543de5371b85332405dc01", "name": "InQuest - 04-05-2023", "description": "", "modified": "2023-05-04T23:21:09.455000", "created": "2023-05-04T23:21:09.455000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 469, "domain": 718, "URL": 1770, "FileHash-MD5": 78, "hostname": 821, "IPv4": 75, "FileHash-SHA1": 69 }, "indicator_count": 4000, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1123 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6452ec4398064bbe35f12ffa", "name": "InQuest - 03-05-2023", "description": "", "modified": "2023-05-03T23:20:35.475000", "created": "2023-05-03T23:20:35.475000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 724, "URL": 1797, "FileHash-SHA1": 69, "IPv4": 73, "FileHash-SHA256": 454, "hostname": 843, "FileHash-MD5": 55 }, "indicator_count": 4015, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1124 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64519b5f16e353d4bebbbdd9", "name": "InQuest - 02-05-2023", "description": "", "modified": "2023-05-02T23:23:11.858000", "created": "2023-05-02T23:23:11.858000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 701, "URL": 1822, "hostname": 891, "FileHash-SHA256": 419, "FileHash-MD5": 55, "IPv4": 72, "FileHash-SHA1": 41 }, "indicator_count": 4001, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1125 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://subinfralab.info/hgAdDiLmnB", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://subinfralab.info/hgAdDiLmnB", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780272631.7509828 }