{ "type": "URL", "indicator": "https://www.robertoscaia.com/eco/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.robertoscaia.com/eco/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3784591395, "indicator": "https://www.robertoscaia.com/eco/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6567d40354a0a84f48a88c93", "name": "InQuest - 29-11-2023", "description": "", "modified": "2023-12-30T00:04:57.002000", "created": "2023-11-30T00:14:59.150000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 143, "hostname": 101, "URL": 436, "FileHash-SHA256": 46, "domain": 55, "FileHash-SHA1": 8 }, "indicator_count": 789, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "885 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655d47ee85cca9f7765a9f2e", "name": "URLHaus data - 21-11-2023", "description": "", "modified": "2023-12-22T00:01:04.661000", "created": "2023-11-22T00:14:38.861000", "tags": [ "SocGholish", "32", "exe", "nitol", "dropped-by-PrivateLoader", "encrypted", "RedLine", "xmrig", "SectopRAT", "hajime", "Mozi", "MarsStealer", "elf", "dropped-by-SmokeLoader", "32-bit", "mips", "shellscript", "WordPressCVE", "agenziaentrate", "stego", "stegoimage", "64", "1234", "Password-protected", "rar", "RemcosRAT", "stego image", "js", "Lumma", "remcos", "arm", "mirai", "njRAT", "List", "SSH Attacker", "dll", "Stealc", "discord", "infostealer", "pwd-charowbeta", "EpsilonStealer", "gz", "bz2", "zgRAT", "xworm", "RedLineStealer", "sparc" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 396, "hostname": 16, "domain": 15 }, "indicator_count": 427, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "893 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656bd53c1ede8fc3b0926d3d", "name": "Hackers Using Fake Invoices to Deliver LUMMA Malware", "description": "", "modified": "2023-12-03T01:09:16.667000", "created": "2023-12-03T01:09:16.667000", "tags": [ "urls", "process ids", "pids", "point", "view", "javascript file", "url redirect", "lumma", "c language", "windows media" ], "references": [ "December 3rd, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3656 - Hackers Using Fake Invoices to Deliver LUMMA Malware" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 6, "domain": 3, "hostname": 2 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "912 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a2d4b95d8553e428161bc", "name": "Behind the Attack: LUMMA Malware - Perception Point", "description": "", "modified": "2023-12-01T19:00:27.844000", "created": "2023-12-01T19:00:27.844000", "tags": [ "urls", "process ids", "pids", "point", "view", "javascript file", "url redirect", "lumma", "c language", "windows media" ], "references": [ "https://perception-point.io/blog/behind-the-attack-lumma-malware/?nstoken=7SOY%2FFbMog3%2FTQb%2FLdUXz8kbPMP4wnAZLmaTwIfEk7gHkThOMV%2F%2Bf9OfldJ1%2F3qCqkuy%2FMf0crIahPgwOQXOw9aLYYwIvTHkYp8fJ7uOEAkRkZe6Ouj5MQX8YEplPF%2BmEf32zxdS71Y%2BGUizs21VXmUREJFVVObhXHteu3S25tlB6sZ5JswTx4F%2Fj98vSZXM00lrw3lEIkTh6Qtd6A8gJLCpTPZl%2FmEpaRhM91dPHWf%2BXSHMkglYxPnN9Ri3wSBiR7%2BhUBlTNigsuH3Pwt%2BtLOK22fkPFqemB4P5mKZRfGbvS%2FDm4q4JP7UgMkJ49cLb%2FSetwdhfiwjyfdLAiv1KO2UY5Zcgu47H7kNZY6W0jmNnTNHqq3PPBmXtnuGSd%2F2Ym6yCBpJ2F1L3WyzpuK5o" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 6, "domain": 3, "hostname": 2 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "913 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://labs.inquest.net/iocdb", "https://urlhaus.abuse.ch/browse/", "December 3rd, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3656 - Hackers Using Fake Invoices to Deliver LUMMA Malware", "https://perception-point.io/blog/behind-the-attack-lumma-malware/?nstoken=7SOY%2FFbMog3%2FTQb%2FLdUXz8kbPMP4wnAZLmaTwIfEk7gHkThOMV%2F%2Bf9OfldJ1%2F3qCqkuy%2FMf0crIahPgwOQXOw9aLYYwIvTHkYp8fJ7uOEAkRkZe6Ouj5MQX8YEplPF%2BmEf32zxdS71Y%2BGUizs21VXmUREJFVVObhXHteu3S25tlB6sZ5JswTx4F%2Fj98vSZXM00lrw3lEIkTh6Qtd6A8gJLCpTPZl%2FmEpaRhM91dPHWf%2BXSHMkglYxPnN9Ri3wSBiR7%2BhUBlTNigsuH3Pwt%2BtLOK22fkPFqemB4P5mKZRfGbvS%2FDm4q4JP7UgMkJ49cLb%2FSetwdhfiwjyfdLAiv1KO2UY5Zcgu47H7kNZY6W0jmNnTNHqq3PPBmXtnuGSd%2F2Ym6yCBpJ2F1L3WyzpuK5o" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Lumma stealer" ], "industries": [], "unique_indicators": 1432 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/robertoscaia.com", "whois": "http://whois.domaintools.com/robertoscaia.com", "domain": "robertoscaia.com", "hostname": "www.robertoscaia.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6567d40354a0a84f48a88c93", "name": "InQuest - 29-11-2023", "description": "", "modified": "2023-12-30T00:04:57.002000", "created": "2023-11-30T00:14:59.150000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 143, "hostname": 101, "URL": 436, "FileHash-SHA256": 46, "domain": 55, "FileHash-SHA1": 8 }, "indicator_count": 789, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "885 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655d47ee85cca9f7765a9f2e", "name": "URLHaus data - 21-11-2023", "description": "", "modified": "2023-12-22T00:01:04.661000", "created": "2023-11-22T00:14:38.861000", "tags": [ "SocGholish", "32", "exe", "nitol", "dropped-by-PrivateLoader", "encrypted", "RedLine", "xmrig", "SectopRAT", "hajime", "Mozi", "MarsStealer", "elf", "dropped-by-SmokeLoader", "32-bit", "mips", "shellscript", "WordPressCVE", "agenziaentrate", "stego", "stegoimage", "64", "1234", "Password-protected", "rar", "RemcosRAT", "stego image", "js", "Lumma", "remcos", "arm", "mirai", "njRAT", "List", "SSH Attacker", "dll", "Stealc", "discord", "infostealer", "pwd-charowbeta", "EpsilonStealer", "gz", "bz2", "zgRAT", "xworm", "RedLineStealer", "sparc" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 396, "hostname": 16, "domain": 15 }, "indicator_count": 427, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "893 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656bd53c1ede8fc3b0926d3d", "name": "Hackers Using Fake Invoices to Deliver LUMMA Malware", "description": "", "modified": "2023-12-03T01:09:16.667000", "created": "2023-12-03T01:09:16.667000", "tags": [ "urls", "process ids", "pids", "point", "view", "javascript file", "url redirect", "lumma", "c language", "windows media" ], "references": [ "December 3rd, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3656 - Hackers Using Fake Invoices to Deliver LUMMA Malware" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 6, "domain": 3, "hostname": 2 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "912 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a2d4b95d8553e428161bc", "name": "Behind the Attack: LUMMA Malware - Perception Point", "description": "", "modified": "2023-12-01T19:00:27.844000", "created": "2023-12-01T19:00:27.844000", "tags": [ "urls", "process ids", "pids", "point", "view", "javascript file", "url redirect", "lumma", "c language", "windows media" ], "references": [ "https://perception-point.io/blog/behind-the-attack-lumma-malware/?nstoken=7SOY%2FFbMog3%2FTQb%2FLdUXz8kbPMP4wnAZLmaTwIfEk7gHkThOMV%2F%2Bf9OfldJ1%2F3qCqkuy%2FMf0crIahPgwOQXOw9aLYYwIvTHkYp8fJ7uOEAkRkZe6Ouj5MQX8YEplPF%2BmEf32zxdS71Y%2BGUizs21VXmUREJFVVObhXHteu3S25tlB6sZ5JswTx4F%2Fj98vSZXM00lrw3lEIkTh6Qtd6A8gJLCpTPZl%2FmEpaRhM91dPHWf%2BXSHMkglYxPnN9Ri3wSBiR7%2BhUBlTNigsuH3Pwt%2BtLOK22fkPFqemB4P5mKZRfGbvS%2FDm4q4JP7UgMkJ49cLb%2FSetwdhfiwjyfdLAiv1KO2UY5Zcgu47H7kNZY6W0jmNnTNHqq3PPBmXtnuGSd%2F2Ym6yCBpJ2F1L3WyzpuK5o" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 6, "domain": 3, "hostname": 2 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "913 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.robertoscaia.com/eco/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.robertoscaia.com/eco/", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "LummaStealer" ], "date_added": "2023-11-21", "last_online": "2023-11-24", "reporter": "anonymous", "host": "www.robertoscaia.com", "payloads": [ { "filename": "0314.exe", "file_type": "exe", "md5": "153fc6f0fb1b7cfe7168b55743891c39", "sha256": "b4ca934eb04d41cc2dcfd732a7415b203cbd8e8915cd587ad96eb19020fc3ff3", "signature": "LummaStealer", "first_seen": "2023-11-24" }, { "filename": "1825.exe", "file_type": "exe", "md5": "321e5e2485e29a7d943ab23d1f60e0fe", "sha256": "f27356f9c795cf64cc36c752848bbcd778766ddb0f0f0536c8e040f0e417b345", "signature": "LummaStealer", "first_seen": "2023-11-23" }, { "filename": "5130.exe", "file_type": "exe", "md5": "37188fcf6730da50fb26d8f07e9e4f3b", "sha256": "2791255152f4e99bfad9a62bbc65d6bcf11b2666a6d88486e7a634fd53e52f59", "signature": "LummaStealer", "first_seen": "2023-11-23" }, { "filename": "1058.exe", "file_type": "exe", "md5": "a036967b537d3ffec26b404cbb3c2e2d", "sha256": "0c7c0440be45cd232f4fda262d5e093a1f9cd369e5428f11fff3647f68733b14", "signature": "LummaStealer", "first_seen": "2023-11-23" }, { "filename": "0417.exe", "file_type": "exe", "md5": "4d92b34994b1b71254e6e11fd50b3ddd", "sha256": "d2c38a9f719cd3be34b879c49c362ee46866a9a1007226c673468cdea6668a0f", "signature": "LummaStealer", "first_seen": "2023-11-23" } ], "error": null }, "from_cache": true, "_cached_at": 1780364228.527241 }