{ "type": "Domain", "indicator": "interactive-soft.xyz", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/interactive-soft.xyz", "alexa": "http://www.alexa.com/siteinfo/interactive-soft.xyz", "indicator": "interactive-soft.xyz", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3483153577, "indicator": "interactive-soft.xyz", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "62c2c88bb0d64cadd68eebaa", "name": "New Info-stealer Disguised as Crack Being Distributed", "description": "The ASEC analysis team has identified a new type of malware that is being distributed as a crack and steal sensitive information from users' computers.", "modified": "2022-08-03T00:05:10.569000", "created": "2022-07-04T11:01:30.768000", "tags": [ "recordbreaker", "stealer" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Recordbreaker", "display_name": "Recordbreaker", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1407", "name": "Download New Code at Runtime", "display_name": "T1407 - Download New Code at Runtime" }, { "id": "T1592", "name": "Gather Victim Host Information", "display_name": "T1592 - Gather Victim Host Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1510", "name": "Clipboard Modification", "display_name": "T1510 - Clipboard Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 424, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 230, "domain": 26 }, "indicator_count": 259, "is_author": false, "is_subscribing": null, "subscriber_count": 386521, "modified_text": "1397 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc06911930b02bf65a51fb", "name": "New Info-stealer Disguised as Crack Being Distributed", "description": "Researchers found various malware types that are being distributed by disguising themselves as software cracks and installers. CryptBot, RedLine, and Vidar are major example cases. Recently, a single malware type of RedLine has disappeared (it is still being distributed as a dropper type) and a new infostealer malware is being actively distributed instead. Its distribution became in full swing starting from May 20th, globally categorized as \u201cRecordbreaker Stealer.\u201d Some analyses see it as a new version of Raccoon Stealer.", "modified": "2022-06-29T08:00:17.210000", "created": "2022-06-29T08:00:17.210000", "tags": [ "recordbreaker", "cryptbot", "redline", "clipbanker", "vidar", "infostealer", "raccoon" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Recordbreaker", "display_name": "Recordbreaker", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "Vidar", "display_name": "Vidar", "target": null }, { "id": "ClipBanker", "display_name": "ClipBanker", "target": null }, { "id": "CryptBot", "display_name": "CryptBot", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 385, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 229, "domain": 26 }, "indicator_count": 258, "is_author": false, "is_subscribing": null, "subscriber_count": 386519, "modified_text": "1432 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669694b25d4fa94af57e271b", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "The Redline Stealer\u2019s website has been used to register more than 100,000 domain registrations in the past two years, according to a new analysis by the security bloggers network.", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-16T15:41:38.351000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669f55ed91ac62173bdd8fd4", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-23T07:04:13.617000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "669694b25d4fa94af57e271b", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669f562a5d60ba548b103ba4", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-23T07:05:14.160000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "669f55ed91ac62173bdd8fd4", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62ba9e5a596093ee77443e67", "name": "New Info-stealer Disguised as Crack Being Distributed - ASEC BLOG", "description": "", "modified": "2022-07-28T00:02:14.384000", "created": "2022-06-28T06:23:22.442000", "tags": [ "local extension", "cache", "cryptbot", "metamask", "ronin", "ahnlab", "redline", "tronlink", "guarda", "ledger live", "clipbanker", "vidar", "malware", "atomic", "temple", "phantom", "june", "code", "infostealer", "raccoon" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 230, "domain": 26 }, "indicator_count": 259, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62b2e1edbfcae74f91623555", "name": "Infostealer IOCs", "description": "Six people have been named as the first to have their names written by a single person, and they have a good chance of doing it in the next few days.--a-day.", "modified": "2022-07-22T00:01:06.959000", "created": "2022-06-22T09:33:33.946000", "tags": [], "references": [ "https://asec.ahnlab.com/ko/35549/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 228, "domain": 24 }, "indicator_count": 252, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://asec.ahnlab.com/ko/35549/", "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/", "https://asec.ahnlab.com/en/35981/" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Raccoon", "Recordbreaker", "Vidar", "Cryptbot", "Clipbanker", "Redline stealer" ], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "62c2c88bb0d64cadd68eebaa", "name": "New Info-stealer Disguised as Crack Being Distributed", "description": "The ASEC analysis team has identified a new type of malware that is being distributed as a crack and steal sensitive information from users' computers.", "modified": "2022-08-03T00:05:10.569000", "created": "2022-07-04T11:01:30.768000", "tags": [ "recordbreaker", "stealer" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Recordbreaker", "display_name": "Recordbreaker", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1407", "name": "Download New Code at Runtime", "display_name": "T1407 - Download New Code at Runtime" }, { "id": "T1592", "name": "Gather Victim Host Information", "display_name": "T1592 - Gather Victim Host Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1510", "name": "Clipboard Modification", "display_name": "T1510 - Clipboard Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 424, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 230, "domain": 26 }, "indicator_count": 259, "is_author": false, "is_subscribing": null, "subscriber_count": 386521, "modified_text": "1397 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc06911930b02bf65a51fb", "name": "New Info-stealer Disguised as Crack Being Distributed", "description": "Researchers found various malware types that are being distributed by disguising themselves as software cracks and installers. CryptBot, RedLine, and Vidar are major example cases. Recently, a single malware type of RedLine has disappeared (it is still being distributed as a dropper type) and a new infostealer malware is being actively distributed instead. Its distribution became in full swing starting from May 20th, globally categorized as \u201cRecordbreaker Stealer.\u201d Some analyses see it as a new version of Raccoon Stealer.", "modified": "2022-06-29T08:00:17.210000", "created": "2022-06-29T08:00:17.210000", "tags": [ "recordbreaker", "cryptbot", "redline", "clipbanker", "vidar", "infostealer", "raccoon" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Recordbreaker", "display_name": "Recordbreaker", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "Vidar", "display_name": "Vidar", "target": null }, { "id": "ClipBanker", "display_name": "ClipBanker", "target": null }, { "id": "CryptBot", "display_name": "CryptBot", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 385, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 229, "domain": 26 }, "indicator_count": 258, "is_author": false, "is_subscribing": null, "subscriber_count": 386519, "modified_text": "1432 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669694b25d4fa94af57e271b", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "The Redline Stealer\u2019s website has been used to register more than 100,000 domain registrations in the past two years, according to a new analysis by the security bloggers network.", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-16T15:41:38.351000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669f55ed91ac62173bdd8fd4", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-23T07:04:13.617000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "669694b25d4fa94af57e271b", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669f562a5d60ba548b103ba4", "name": "Exposing the C&C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "description": "", "modified": "2024-08-15T15:04:13.735000", "created": "2024-07-23T07:05:14.160000", "tags": [ "redline stealer", "dancho danchev", "whoisxml api", "whois database", "sample", "md5s", "network", "blog", "mind streams", "knowledge" ], "references": [ "https://securityboulevard.com/2024/06/exposing-the-cc-and-ioc-infrastructure-of-the-redline-stealer-malicious-software-an-analysis/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "669f55ed91ac62173bdd8fd4", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 54, "FileHash-MD5": 22, "FileHash-SHA1": 22, "FileHash-SHA256": 144, "CVE": 1, "domain": 52, "hostname": 2 }, "indicator_count": 297, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "653 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62ba9e5a596093ee77443e67", "name": "New Info-stealer Disguised as Crack Being Distributed - ASEC BLOG", "description": "", "modified": "2022-07-28T00:02:14.384000", "created": "2022-06-28T06:23:22.442000", "tags": [ "local extension", "cache", "cryptbot", "metamask", "ronin", "ahnlab", "redline", "tronlink", "guarda", "ledger live", "clipbanker", "vidar", "malware", "atomic", "temple", "phantom", "june", "code", "infostealer", "raccoon" ], "references": [ "https://asec.ahnlab.com/en/35981/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 3, "FileHash-MD5": 230, "domain": 26 }, "indicator_count": 259, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62b2e1edbfcae74f91623555", "name": "Infostealer IOCs", "description": "Six people have been named as the first to have their names written by a single person, and they have a good chance of doing it in the next few days.--a-day.", "modified": "2022-07-22T00:01:06.959000", "created": "2022-06-22T09:33:33.946000", "tags": [], "references": [ "https://asec.ahnlab.com/ko/35549/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 228, "domain": 24 }, "indicator_count": 252, "is_author": false, "is_subscribing": null, "subscriber_count": 128, "modified_text": "1409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "interactive-soft.xyz", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "interactive-soft.xyz", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780227540.1268928 }