{ "type": "URL", "indicator": "https://web.erwbtkidthetcwerc.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://web.erwbtkidthetcwerc.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3778134561, "indicator": "https://web.erwbtkidthetcwerc.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "659d15c13f838593a01984b6", "name": "Project Hilo", "description": "", "modified": "2024-02-08T09:05:26.319000", "created": "2024-01-09T09:45:37.584000", "tags": [ "creation date", "servers", "passive dns", "urls", "search", "name servers", "scan endpoints", "all octoseek", "hostname", "pulse pulses", "date", "next", "showing", "files", "files ip", "whois record", "ssl certificate", "historical ssl", "resolutions", "whois whois", "siblings", "trojan bank", "m referrer", "subdomains", "execution", "dropped", "whois", "bank", "parent siblings", "referrer", "as8075", "united", "nxdomain", "united kingdom", "south korea", "unknown", "mascore2", "nct1", "arc1", "ems1", "localeenus", "htd1", "lang1033", "devlangen" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 536, "email": 3, "hostname": 1486, "URL": 2496, "FileHash-SHA256": 784, "FileHash-MD5": 27, "FileHash-SHA1": 13 }, "indicator_count": 5345, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "802 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6552d60aae6e1b3c22455088", "name": "Hive 0065", "description": "Hive 0065\nURL: https://applemusic-spotlight.myunidays.com/US/en-US?\n\nHive 0065\nHostname: applemusic-spotlight.myunidays.com", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-14T02:06:02.329000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6552d6f5f56d2e9cd9e18a30", "name": "Lolkek \u2022 FormBook \u2022 Lokbit \u2022 Skynet", "description": "Hive 0065\nURL: https://applemusic-spotlight.myunidays.com/US/en-US?\n\nHive 0065\nHostname: applemusic-spotlight.myunidays.com", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-14T02:09:57.370000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65568b00198f82af2e88d463", "name": "Lolkek \u2022 FormBook \u2022 Lokbit \u2022 Skynet", "description": "", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-16T21:34:56.016000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6552d6f5f56d2e9cd9e18a30", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65521fdfdf567667e07becf1", "name": "trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net", "description": "spyware, tracking, evasive, invasive, malicious", "modified": "2023-12-13T05:00:43.179000", "created": "2023-11-13T13:08:47.093000", "tags": [ "cisco umbrella", "alexa top", "site", "million", "safe site", "alexa", "detection list", "blacklist", "team alexa", "subdomains", "search", "domain related", "emotet", "telefonica co", "soc alexa" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 439, "email": 3, "hostname": 1211, "FileHash-MD5": 17, "FileHash-SHA1": 17, "FileHash-SHA256": 789, "URL": 2391 }, "indicator_count": 4867, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a97db9134b17c1f6d845b", "name": "DeepScan:Generic.Ransom.GandCrab5", "description": "", "modified": "2023-12-02T02:35:07.890000", "created": "2023-12-02T02:35:07.890000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541df216e018a0bce63e2a3", "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "870 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6541df216e018a0bce63e2a3", "name": "DeepScan:Generic.Ransom.GandCrab5", "description": "Malicious redirect. OWA? Dreaded Canary cookie? I don't know yet. Link affects individuals, corporations and edu's. \n\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-01T05:16:17.835000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6541e08c81e836438946bbbf", "name": "TrojanSpy", "description": "Malicious redirect. Targets individual.\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-01T05:22:20.519000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6543350c86e1299dc78bfa90", "name": "this dick", "description": "", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-02T05:35:08.226000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541df216e018a0bce63e2a3", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Nicholus33", "id": "76046", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 207, "URI": 1 }, "indicator_count": 7766, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6545a25d60272bac5827f2fc", "name": "TrojanSpy", "description": "", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-04T01:46:05.174000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541e08c81e836438946bbbf", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Trojanspy", "Webtoolbar" ], "industries": [], "unique_indicators": 32921 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/erwbtkidthetcwerc.com", "whois": "http://whois.domaintools.com/erwbtkidthetcwerc.com", "domain": "erwbtkidthetcwerc.com", "hostname": "web.erwbtkidthetcwerc.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "659d15c13f838593a01984b6", "name": "Project Hilo", "description": "", "modified": "2024-02-08T09:05:26.319000", "created": "2024-01-09T09:45:37.584000", "tags": [ "creation date", "servers", "passive dns", "urls", "search", "name servers", "scan endpoints", "all octoseek", "hostname", "pulse pulses", "date", "next", "showing", "files", "files ip", "whois record", "ssl certificate", "historical ssl", "resolutions", "whois whois", "siblings", "trojan bank", "m referrer", "subdomains", "execution", "dropped", "whois", "bank", "parent siblings", "referrer", "as8075", "united", "nxdomain", "united kingdom", "south korea", "unknown", "mascore2", "nct1", "arc1", "ems1", "localeenus", "htd1", "lang1033", "devlangen" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 536, "email": 3, "hostname": 1486, "URL": 2496, "FileHash-SHA256": 784, "FileHash-MD5": 27, "FileHash-SHA1": 13 }, "indicator_count": 5345, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "802 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6552d60aae6e1b3c22455088", "name": "Hive 0065", "description": "Hive 0065\nURL: https://applemusic-spotlight.myunidays.com/US/en-US?\n\nHive 0065\nHostname: applemusic-spotlight.myunidays.com", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-14T02:06:02.329000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6552d6f5f56d2e9cd9e18a30", "name": "Lolkek \u2022 FormBook \u2022 Lokbit \u2022 Skynet", "description": "Hive 0065\nURL: https://applemusic-spotlight.myunidays.com/US/en-US?\n\nHive 0065\nHostname: applemusic-spotlight.myunidays.com", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-14T02:09:57.370000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65568b00198f82af2e88d463", "name": "Lolkek \u2022 FormBook \u2022 Lokbit \u2022 Skynet", "description": "", "modified": "2023-12-13T16:00:45.799000", "created": "2023-11-16T21:34:56.016000", "tags": [ "united", "as8075", "creation date", "unknown", "search", "entries", "asnone country", "scan endpoints", "all search", "otx octoseek", "related domains", "show", "domain related", "xbox", "whois record", "contacted", "whois whois", "ssl certificate", "communicating", "referrer", "execution", "historical ssl", "bundled", "family", "lolkek", "formbook", "skynet", "lockbit", "ursnif", "attack", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6552d6f5f56d2e9cd9e18a30", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4276, "email": 3, "hostname": 2288, "FileHash-MD5": 51, "FileHash-SHA1": 49, "FileHash-SHA256": 2756, "URL": 8696, "CVE": 1 }, "indicator_count": 18120, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65521fdfdf567667e07becf1", "name": "trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net", "description": "spyware, tracking, evasive, invasive, malicious", "modified": "2023-12-13T05:00:43.179000", "created": "2023-11-13T13:08:47.093000", "tags": [ "cisco umbrella", "alexa top", "site", "million", "safe site", "alexa", "detection list", "blacklist", "team alexa", "subdomains", "search", "domain related", "emotet", "telefonica co", "soc alexa" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 439, "email": 3, "hostname": 1211, "FileHash-MD5": 17, "FileHash-SHA1": 17, "FileHash-SHA256": 789, "URL": 2391 }, "indicator_count": 4867, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "859 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a97db9134b17c1f6d845b", "name": "DeepScan:Generic.Ransom.GandCrab5", "description": "", "modified": "2023-12-02T02:35:07.890000", "created": "2023-12-02T02:35:07.890000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541df216e018a0bce63e2a3", "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "870 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6541df216e018a0bce63e2a3", "name": "DeepScan:Generic.Ransom.GandCrab5", "description": "Malicious redirect. OWA? Dreaded Canary cookie? I don't know yet. Link affects individuals, corporations and edu's. \n\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-01T05:16:17.835000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6541e08c81e836438946bbbf", "name": "TrojanSpy", "description": "Malicious redirect. Targets individual.\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-01T05:22:20.519000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6543350c86e1299dc78bfa90", "name": "this dick", "description": "", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-02T05:35:08.226000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541df216e018a0bce63e2a3", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Nicholus33", "id": "76046", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 207, "URI": 1 }, "indicator_count": 7766, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6545a25d60272bac5827f2fc", "name": "TrojanSpy", "description": "", "modified": "2023-12-01T04:05:20.963000", "created": "2023-11-04T01:46:05.174000", "tags": [ "cisco umbrella", "site", "safe site", "detection list", "blacklist", "million", "malicious url", "maltiverse", "heuristic", "redirme", "exploit", "malware", "team", "microsoft", "urlhttps", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "hacktool", "arkeistealer", "mail spammer", "united", "germany", "opencandy", "proxy", "firehol", "alexa top", "phishing site", "malicious site", "malware site", "alexa", "phishing", "iframe", "downldr", "agent", "presenoker", "riskware", "unsafe", "artemis", "bank", "cve201711882", "tag count", "cyber threat", "httponly", "samesitenone", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "pragma", "contacted urls", "ssl certificate", "whois record", "xmodeargs", "whois whois", "xdpid1203", "xpubid10839", "september", "tsara brashears", "collection", "emotet", "malicious", "critical", "copy", "installer", "banker", "keylogger", "heur", "filerepmetagen", "suspected", "adware", "acint", "nircmd", "swrort", "systweak", "behav", "crack", "tiggre", "genkryptik", "filetour", "cleaner", "conduit", "wacatac", "trojanspy", "webtoolbar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6541e08c81e836438946bbbf", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2559, "CVE": 6, "FileHash-MD5": 582, "FileHash-SHA1": 353, "FileHash-SHA256": 3232, "hostname": 826, "domain": 206, "URI": 1 }, "indicator_count": 7765, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "871 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://web.erwbtkidthetcwerc.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://web.erwbtkidthetcwerc.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776703077.9644399 }