{ "type": "URL", "indicator": "https://wizard-individual-intervals-franklin.trycloudflare.com/kolo.bat", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://wizard-individual-intervals-franklin.trycloudflare.com/kolo.bat", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4072083944, "indicator": "https://wizard-individual-intervals-franklin.trycloudflare.com/kolo.bat", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "683b2878b997cc1bfc7e9857", "name": "APT41's \"ToughProgress\" Malware Abuses Google Calendar for C2 Evasion", "description": "This pulse details APT41's (Winnti Group) new \"ToughProgress\" malware, which weaponizes Google Calendar for stealthy command-and-control (C2) communications. Key highlights from SOCRadar's analysis:\nLegitimacy Abuse: Uses Google Calendar events to hide malicious commands in seemingly benign public calendar entries.\nMulti-Stage Execution: Delivers PowerShell scripts to fetch encrypted payloads, bypassing traditional network defences.\nPersistence Mechanisms: Establishes footholds via scheduled tasks, registry modifications, and DLL sideloading.\nTargeted Evasion: Avoids sandboxes and leverages trusted cloud services to evade detection.\nIOCs Provided: Includes malware hashes, C2 domains, and behavioural patterns for hunting.", "modified": "2025-05-31T16:04:08.616000", "created": "2025-05-31T16:04:08.616000", "tags": [], "references": [], "public": 1, "adversary": "Winnti Group", "targeted_countries": [], "malware_families": [ { "id": "ToughProgress", "display_name": "ToughProgress", "target": null } ], "attack_ids": [ { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1574.002", "name": "DLL Side-Loading", "display_name": "T1574.002 - DLL Side-Loading" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1552.001", "name": "Credentials In Files", "display_name": "T1552.001 - Credentials In Files" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 3, "FileHash-SHA256": 4, "hostname": 23, "domain": 2, "URL": 41 }, "indicator_count": 77, "is_author": false, "is_subscribing": null, "subscriber_count": 541, "modified_text": "365 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Winnti Group" ], "malware_families": [ "Toughprogress" ], "industries": [], "unique_indicators": 319 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/trycloudflare.com", "whois": "http://whois.domaintools.com/trycloudflare.com", "domain": "trycloudflare.com", "hostname": "wizard-individual-intervals-franklin.trycloudflare.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "683b2878b997cc1bfc7e9857", "name": "APT41's \"ToughProgress\" Malware Abuses Google Calendar for C2 Evasion", "description": "This pulse details APT41's (Winnti Group) new \"ToughProgress\" malware, which weaponizes Google Calendar for stealthy command-and-control (C2) communications. Key highlights from SOCRadar's analysis:\nLegitimacy Abuse: Uses Google Calendar events to hide malicious commands in seemingly benign public calendar entries.\nMulti-Stage Execution: Delivers PowerShell scripts to fetch encrypted payloads, bypassing traditional network defences.\nPersistence Mechanisms: Establishes footholds via scheduled tasks, registry modifications, and DLL sideloading.\nTargeted Evasion: Avoids sandboxes and leverages trusted cloud services to evade detection.\nIOCs Provided: Includes malware hashes, C2 domains, and behavioural patterns for hunting.", "modified": "2025-05-31T16:04:08.616000", "created": "2025-05-31T16:04:08.616000", "tags": [], "references": [], "public": 1, "adversary": "Winnti Group", "targeted_countries": [], "malware_families": [ { "id": "ToughProgress", "display_name": "ToughProgress", "target": null } ], "attack_ids": [ { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1574.002", "name": "DLL Side-Loading", "display_name": "T1574.002 - DLL Side-Loading" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1552.001", "name": "Credentials In Files", "display_name": "T1552.001 - Credentials In Files" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 3, "FileHash-SHA256": 4, "hostname": 23, "domain": 2, "URL": 41 }, "indicator_count": 77, "is_author": false, "is_subscribing": null, "subscriber_count": 541, "modified_text": "365 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://wizard-individual-intervals-franklin.trycloudflare.com/kolo.bat", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://wizard-individual-intervals-franklin.trycloudflare.com/kolo.bat", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [], "date_added": "2025-05-31", "last_online": "", "reporter": "anonymous", "host": "wizard-individual-intervals-franklin.trycloudflare.com", "payloads": [], "error": null }, "from_cache": true, "_cached_at": 1780290166.0061746 }