{ "type": "URL", "indicator": "https://x34.mdelbxui.net", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://x34.mdelbxui.net", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4109878033, "indicator": "https://x34.mdelbxui.net", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "6894fd48178a2cc0c287af71", "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s + | Device local *Remowted.com", "description": "", "modified": "2025-09-06T19:01:20.165000", "created": "2025-08-07T19:23:52.346000", "tags": [ "filehashmd5", "indicator role", "title added", "active related", "filehashsha256", "t1105", "tool transfer", "t1480", "guardrails", "t1566", "t1568", "t1012", "t1023", "t1031", "service", "filehashsha1", "iocs", "learn more", "hostname", "types of", "netherlands", "united", "denmark", "belgium", "dynamicloader", "yara rule", "vmdetect", "write c", "search", "medium", "show", "entries", "high", "worm", "copy", "write", "unknown", "markus", "malware", "suspicious", "crlf line", "unicode text", "utf8", "ascii text", "trojan", "music", "next", "autorun" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 129, "FileHash-SHA256": 713, "URL": 2616, "domain": 338, "hostname": 598, "email": 7 }, "indicator_count": 4622, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "225 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688d5b9a901f21d7148c4f08", "name": "Data Server - |Win.Trojan.Shiz, \u2022PWS:Win32/Simda.D", "description": "- dl.fdlserver.com appears to be or have been used as a software and / or data delivery service. Requires further investigation. It sure is malicious. Found in multiple attacks.\n*Win.Trojan.Shiz-664 , *PWS:Win32/Simda.D\nIDS Detections:\n\u2022 Unsupported/Fake Internet Explorer Version MSIE 2.\n\u2022 Unsupported/Fake Windows NT Version 5.0\nYara Detections: \n\u2022 generic_shellcode_downloader\nAlerts\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 antiav_detectfile\n\u2022 deletes_self\n\u2022 dynamic_function_loading\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx\n\u2022 stealth_network\n\u2022 queries_user_name\n\u2022 stealth_timeout\n\u2022 language_check", "modified": "2025-09-01T00:04:55.557000", "created": "2025-08-02T00:28:10.007000", "tags": [ "united", "entries", "passive dns", "virtool", "next associated", "ipv4 add", "pulse pulses", "urls", "files", "hosting", "body", "present jun", "present may", "present oct", "present apr", "present nov", "present jan", "present dec", "present jul", "netherlands", "present aug", "present feb", "creation date", "status", "ip address", "search", "name", "name servers", "expiration date", "date", "dynamicloader", "unknown", "msie", "windows nt", "slcc2", "media center", "show", "write", "copy", "simda", "malware", "push", "extraction", "failed", "data upload", "include", "extraction data", "enter soudae", "lidi ad", "tewdaccarad ad", "ddawce type", "extri", "include review", "extra", "include data", "location united", "medium", "record value", "cowboy", "encrypt", "high" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 402, "FileHash-SHA1": 400, "FileHash-SHA256": 1798, "URL": 7586, "domain": 937, "hostname": 2470, "email": 1, "SSLCertFingerprint": 1, "CVE": 1 }, "indicator_count": 13596, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "231 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 18119 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/mdelbxui.net", "whois": "http://whois.domaintools.com/mdelbxui.net", "domain": "mdelbxui.net", "hostname": "x34.mdelbxui.net" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "6894fd48178a2cc0c287af71", "name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s + | Device local *Remowted.com", "description": "", "modified": "2025-09-06T19:01:20.165000", "created": "2025-08-07T19:23:52.346000", "tags": [ "filehashmd5", "indicator role", "title added", "active related", "filehashsha256", "t1105", "tool transfer", "t1480", "guardrails", "t1566", "t1568", "t1012", "t1023", "t1031", "service", "filehashsha1", "iocs", "learn more", "hostname", "types of", "netherlands", "united", "denmark", "belgium", "dynamicloader", "yara rule", "vmdetect", "write c", "search", "medium", "show", "entries", "high", "worm", "copy", "write", "unknown", "markus", "malware", "suspicious", "crlf line", "unicode text", "utf8", "ascii text", "trojan", "music", "next", "autorun" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 129, "FileHash-SHA256": 713, "URL": 2616, "domain": 338, "hostname": 598, "email": 7 }, "indicator_count": 4622, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "225 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688d5b9a901f21d7148c4f08", "name": "Data Server - |Win.Trojan.Shiz, \u2022PWS:Win32/Simda.D", "description": "- dl.fdlserver.com appears to be or have been used as a software and / or data delivery service. Requires further investigation. It sure is malicious. Found in multiple attacks.\n*Win.Trojan.Shiz-664 , *PWS:Win32/Simda.D\nIDS Detections:\n\u2022 Unsupported/Fake Internet Explorer Version MSIE 2.\n\u2022 Unsupported/Fake Windows NT Version 5.0\nYara Detections: \n\u2022 generic_shellcode_downloader\nAlerts\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 antiav_detectfile\n\u2022 deletes_self\n\u2022 dynamic_function_loading\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx\n\u2022 stealth_network\n\u2022 queries_user_name\n\u2022 stealth_timeout\n\u2022 language_check", "modified": "2025-09-01T00:04:55.557000", "created": "2025-08-02T00:28:10.007000", "tags": [ "united", "entries", "passive dns", "virtool", "next associated", "ipv4 add", "pulse pulses", "urls", "files", "hosting", "body", "present jun", "present may", "present oct", "present apr", "present nov", "present jan", "present dec", "present jul", "netherlands", "present aug", "present feb", "creation date", "status", "ip address", "search", "name", "name servers", "expiration date", "date", "dynamicloader", "unknown", "msie", "windows nt", "slcc2", "media center", "show", "write", "copy", "simda", "malware", "push", "extraction", "failed", "data upload", "include", "extraction data", "enter soudae", "lidi ad", "tewdaccarad ad", "ddawce type", "extri", "include review", "extra", "include data", "location united", "medium", "record value", "cowboy", "encrypt", "high" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 402, "FileHash-SHA1": 400, "FileHash-SHA256": 1798, "URL": 7586, "domain": 937, "hostname": 2470, "email": 1, "SSLCertFingerprint": 1, "CVE": 1 }, "indicator_count": 13596, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "231 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://x34.mdelbxui.net", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://x34.mdelbxui.net", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776643667.275522 }