{ "type": "URL", "indicator": "https://sudaksha.com/uc/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://sudaksha.com/uc/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3690491440, "indicator": "https://sudaksha.com/uc/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "6696ce61e8eb76891fbaa493", "name": "Qakbot Trojan IOCs - Part 38 - SEC-1275-1", "description": "", "modified": "2024-08-15T19:03:41.303000", "created": "2024-07-16T19:47:45.415000", "tags": [ "qakbot trojan", "iocs", "qbot", "qakbot", "toggle", "compromise ipv4", "adaniel", "azboncak", "jcorwin", "jlueilwitz" ], "references": [ "https://1275.ru/ioc/2033/qakbot-trojan-iocs-part-38/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 156, "FileHash-SHA1": 11, "FileHash-SHA256": 34, "URL": 1084, "domain": 472, "email": 318, "hostname": 19 }, "indicator_count": 2094, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://1275.ru/ioc/2033/qakbot-trojan-iocs-part-38/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 4233 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/sudaksha.com", "whois": "http://whois.domaintools.com/sudaksha.com", "domain": "sudaksha.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "6696ce61e8eb76891fbaa493", "name": "Qakbot Trojan IOCs - Part 38 - SEC-1275-1", "description": "", "modified": "2024-08-15T19:03:41.303000", "created": "2024-07-16T19:47:45.415000", "tags": [ "qakbot trojan", "iocs", "qbot", "qakbot", "toggle", "compromise ipv4", "adaniel", "azboncak", "jcorwin", "jlueilwitz" ], "references": [ "https://1275.ru/ioc/2033/qakbot-trojan-iocs-part-38/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 156, "FileHash-SHA1": 11, "FileHash-SHA256": 34, "URL": 1084, "domain": 472, "email": 318, "hostname": 19 }, "indicator_count": 2094, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://sudaksha.com/uc/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://sudaksha.com/uc/", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "BB30", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ], "date_added": "2023-06-01", "last_online": "2023-06-03", "reporter": "Cryptolaemus1", "host": "sudaksha.com", "payloads": [ { "filename": "document_C529_Jun_2.zip", "file_type": "zip", "md5": "2e52c15a5d87efe3f1d2f66cac22c742", "sha256": "60b5bc8223d0a6db2426ec81483448d348877036836b7e819d3f68e0237662e2", "signature": null, "first_seen": "2023-06-03" }, { "filename": "document_C907_Jun_2.zip", "file_type": "zip", "md5": "7f3bd60c43e636f12b13c939a89de0a2", "sha256": "c4593fdf50ef5585b6de9e04f7411853e9e5630f8d9927649731d681259e9e19", "signature": null, "first_seen": "2023-06-03" }, { "filename": "document_A496_Jun_2.zip", "file_type": "zip", "md5": "4e05226a9d7c929cba2150f998383b89", "sha256": "9338852664285c0c8c490f981ad014089d3d8b4e9469a3305a7a5e0a0a266bb7", "signature": null, "first_seen": "2023-06-03" }, { "filename": "document_D706_Jun_2.zip", "file_type": "zip", "md5": "9f67b3d392775017c29b4b60e05bd0c0", "sha256": "d054595f11865d4511f1395f51a89eab8d590fc684649c279838ec3ff07e2776", "signature": null, "first_seen": "2023-06-03" }, { "filename": "document_E621_Jun_2.zip", "file_type": "zip", "md5": "851fa3a15ad5efcb5db4048d129a0d59", "sha256": "ac8593e64621719f65fda20c0e4201cb21372e1618f88128b6179db43ae821bf", "signature": null, "first_seen": "2023-06-03" } ], "error": null }, "from_cache": true, "_cached_at": 1780235451.0975347 }