{ "type": "Domain", "indicator": "itfolkstechnology.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/itfolkstechnology.com", "alexa": "http://www.alexa.com/siteinfo/itfolkstechnology.com", "indicator": "itfolkstechnology.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3651774323, "indicator": "itfolkstechnology.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6502e4720ffdf5b89b2ce20f", "name": "Phishing Campaign", "description": "The provided indicators are being utilized for a phishing campaign.", "modified": "2026-03-10T08:26:36.633000", "created": "2023-09-14T10:46:10.926000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ivolyubenov", "id": "199323", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_199323/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 149, "email": 19, "hostname": 68, "FileHash-SHA256": 7, "URL": 3 }, "indicator_count": 246, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "82 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a82dd23bf49fa6bec729", "name": "IOC202310090007", "description": "", "modified": "2023-12-06T16:58:21.517000", "created": "2023-12-06T16:58:21.517000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "URL": 152, "FileHash-SHA256": 423, "hostname": 182, "domain": 58, "FileHash-MD5": 17, "FileHash-SHA1": 1 }, "indicator_count": 837, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6525d9e993c1ec092c6bd5d5", "name": "URLHaus data - 10-10-2023", "description": "", "modified": "2023-11-09T23:00:12.133000", "created": "2023-10-10T23:10:33.204000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "32-bit", "elf", "x86-32", "SocGholish", "mips", "Mozi", "32", "arm", "bashlite", "gafgyt", "sparc", "64", "PowerPC", "shellscript", "hajime", "mirai", "motorola", "intel", "renesas", "LummaStealer", "android", "apk", "IRATA", "dropped-by-SmokeLoader", "RaccoonStealer", "DarkGate", "exe", "Formbook", "redir-302", "xmrig", "AgentTesla", "discord", "infostealer", "1234", "7z", "Password-protected", "PDF", "TA577", "TR", "agenziaentrate", "geo", "Gozi", "ITA", "ursnif", "RedLineStealer", "opendir", "GuLoader", "doc", "gating", "GootLoader", "ISFB", "RedLine", "rat", "RemcosRAT", "docx", "Loki", "vbs", "dll", "Stealc", "aggah", "ascii", "hagga", "powershell", "ps1", "ddos", "PrivateLoader", "risepro", "SystemBC", "lnk", "Vidar", "remcos", "qbot", "Sakura", "script", "dcrat", "64-bit", "x86-64", "upx" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 68, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 663, "hostname": 36, "domain": 449 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "934 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65232828c3d7288d1ab6ebca", "name": "IOC202310090007", "description": "IP addresses are the most common type of address on the internet, but they are also the least likely to be used by people with a particular interest in their address book or email address, as well as by their own.", "modified": "2023-11-07T22:02:18.651000", "created": "2023-10-08T22:07:36.317000", "tags": [ "october", "september", "snake keylogger", "seen", "track them", "all at", "chatgpt", "change", "api quotas", "orcus rat", "danabot", "qbot", "agent tesla", "emotet", "august", "strrat", "gcleaner", "raccoon", "ficker stealer", "redline", "quasar rat", "snake", "asyncrat", "remcos", "quasar", "privateloader", "netwire", "darkcomet", "xworm", "orcus", "rats", "trojan", "redline stealer", "systembc", "malware", "wannacry", "houdini", "qakbot", "azorult", "powershell", "agenttesla", "bladabindi", "discord", "april", "first", "njrat", "smokeloader", "smoke loader", "inst", "ukraine", "fallout", "teamviewer", "cobaltstrike", "hworm", "formbook", "macos", "predator", "february", "rust", "vidar", "icedid", "pony", "eternalblue", "desktop", "mars", "adwind", "crimson rat", "trickbot", "cobalt strike", "flawedammyy", "crypto", "dcrat", "racealer", "belarus", "open", "ursnif", "hawkeye", "gootkit", "hancitor", "apart", "ryuk", "egregor", "dunihi", "jenxcus", "xtremerat", "poisonivy", "nanocore", "pinkslipbot", "path", "screen", "email", "tesla", "wannycry", "microsoft", "oski", "arkei", "ryuk", "wsh", "matiex", "remote access", "wshrat", "any.run", "ficker" ], "references": [], "public": 1, "adversary": "Email", "targeted_countries": [ "Germany", "Austria", "India", "Canada", "Switzerland", "Russian Federation", "Ukraine", "Belarus", "Kazakhstan", "Kyrgyzstan", "Armenia", "Tajikistan", "Uzbekistan", "Poland", "Italy" ], "malware_families": [ { "id": "Tesla", "display_name": "Tesla", "target": null }, { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "Microsoft", "display_name": "Microsoft", "target": null }, { "id": "AsyncRAT", "display_name": "AsyncRAT", "target": null }, { "id": "Oski", "display_name": "Oski", "target": null }, { "id": "Arkei", "display_name": "Arkei", "target": null }, { "id": "SmokeLoader", "display_name": "SmokeLoader", "target": null }, { "id": "XWorm", "display_name": "XWorm", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "FlawedAmmyy", "display_name": "FlawedAmmyy", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "PrivateLoader", "display_name": "PrivateLoader", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "Azorult", "display_name": "Azorult", "target": null }, { "id": "Email", "display_name": "Email", "target": null }, { "id": "Ryuk", "display_name": "Ryuk", "target": null }, { "id": "Houdini", "display_name": "Houdini", "target": null }, { "id": "WSH", "display_name": "WSH", "target": null }, { "id": "Hancitor", "display_name": "Hancitor", "target": null }, { "id": "Matiex", "display_name": "Matiex", "target": null }, { "id": "Vidar", "display_name": "Vidar", "target": null }, { "id": "NJRAT", "display_name": "NJRAT", "target": null }, { "id": "Bladabindi", "display_name": "Bladabindi", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "GCleaner", "display_name": "GCleaner", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "STRRAT", "display_name": "STRRAT", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Danabot", "display_name": "Danabot", "target": null }, { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "DarkComet", "display_name": "DarkComet", "target": null }, { "id": "WSHRAT", "display_name": "WSHRAT", "target": null }, { "id": "ANY.RUN", "display_name": "ANY.RUN", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Ficker", "display_name": "Ficker", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Netwire", "display_name": "Netwire", "target": null }, { "id": "njRAT", "display_name": "njRAT", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Orcus", "display_name": "Orcus", "target": null }, { "id": "Snake", "display_name": "Snake", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1111", "name": "Two-Factor Authentication Interception", "display_name": "T1111 - Two-Factor Authentication Interception" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1072", "name": "Software Deployment Tools", "display_name": "T1072 - Software Deployment Tools" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Banking", "Healthcare", "Cryptocurrency", "Banks", "Energy", "Government", "Manufacturing", "Hospitality", "Transportation" ], "TLP": "white", "cloned_from": null, "export_count": 63, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "FileHash-MD5": 17, "FileHash-SHA1": 1, "FileHash-SHA256": 423, "URL": 152, "domain": 58, "hostname": 182 }, "indicator_count": 837, "is_author": false, "is_subscribing": null, "subscriber_count": 420, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "645d789f1dce2e8d9b7b749d", "name": "URLHaus data - 11-05-2023", "description": "", "modified": "2023-05-11T23:22:07.029000", "created": "2023-05-11T23:22:07.029000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "arm", "mirai", "exe", "njRAT", "32", "Smoke Loader", "MassLogger", "opendir", "SnakeKeylogger", "AgentTesla", "hta", "rat", "RevengeRAT", "additionalpayloads", "RaccoonStealer", "raccoonv2", "RecordBreaker", "NetSupport", "zip", "ascii", "powershell", "ps", "doc", "dcrat", "CoinMiner", "ArkeiStealer", "RedLineStealer", "Password-protected", "rar", "gafgyt", "BB27", "geofenced", "js", "Qakbot", "USA", "Quakbot", "dll", "ua-ps", "Encoded", "RemcosRAT", "encrypted", "1231", "dropped-by-PrivateLoader", "dropped-by-SmokeLoader", "1234", "7z", "qbot", "1515", "SocGholish", "AveMariaRAT", "shellscript", "sparc", "motorola", "renesas", "BlackGuard", "intel", "PowerPC", "iso", "64", "Amadey", "banker", "BRA", "downloader", "smuggling", "trojan", "GuLoader", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 911, "IPv4": 341, "domain": 265, "hostname": 10 }, "indicator_count": 1527, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6420d63082e8ecb0d23f5b86", "name": "URLHaus data - 26-03-2023", "description": "", "modified": "2023-04-25T23:00:38.583000", "created": "2023-03-26T23:33:04.177000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "arm", "exe", "Rhadamanthys", "RedLineStealer", "1234", "7z", "Password-protected", "SocGholish", "32", "bashlite", "gafgyt", "motorola", "PowerPC", "sparc", "64", "intel", "shellscript", "renesas", "dropped-by-PrivateLoader", "encrypted", "RedLine", "dll", "Stealc", "x86-32", "212-113-116-143", "cochang", "pw feiyang", "zip", "pw cochang", "Vidar", "Amadey", "PrivateLoader", "Tsunami", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 3, "hostname": 2 }, "indicator_count": 1005, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Email" ], "malware_families": [ "Microsoft", "Flawedammyy", "Wannacry", "Asyncrat", "Gcleaner", "Houdini", "Wsh", "Njrat", "Wshrat", "Redline", "Netwire", "Qbot", "Trickbot", "Remote access", "Smokeloader", "Ficker", "Danabot", "Quasar", "Oski", "Ryuk", "Any.run", "Privateloader", "Snake", "Agent tesla", "Arkei", "Strrat", "Xworm", "Bladabindi", "Darkcomet", "Ursnif", "Emotet", "Matiex", "Hancitor", "Qakbot", "Cobalt strike", "Wannycry", "Orcus", "Remcos", "Systembc", "Tesla", "Azorult", "Vidar", "Raccoon", "Email" ], "industries": [ "Government", "Cryptocurrency", "Healthcare", "Hospitality", "Banks", "Energy", "Banking", "Manufacturing", "Transportation" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6502e4720ffdf5b89b2ce20f", "name": "Phishing Campaign", "description": "The provided indicators are being utilized for a phishing campaign.", "modified": "2026-03-10T08:26:36.633000", "created": "2023-09-14T10:46:10.926000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ivolyubenov", "id": "199323", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_199323/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 149, "email": 19, "hostname": 68, "FileHash-SHA256": 7, "URL": 3 }, "indicator_count": 246, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "82 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a82dd23bf49fa6bec729", "name": "IOC202310090007", "description": "", "modified": "2023-12-06T16:58:21.517000", "created": "2023-12-06T16:58:21.517000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "URL": 152, "FileHash-SHA256": 423, "hostname": 182, "domain": 58, "FileHash-MD5": 17, "FileHash-SHA1": 1 }, "indicator_count": 837, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6525d9e993c1ec092c6bd5d5", "name": "URLHaus data - 10-10-2023", "description": "", "modified": "2023-11-09T23:00:12.133000", "created": "2023-10-10T23:10:33.204000", "tags": [ "dropped-by-PrivateLoader", "encrypted", "32-bit", "elf", "x86-32", "SocGholish", "mips", "Mozi", "32", "arm", "bashlite", "gafgyt", "sparc", "64", "PowerPC", "shellscript", "hajime", "mirai", "motorola", "intel", "renesas", "LummaStealer", "android", "apk", "IRATA", "dropped-by-SmokeLoader", "RaccoonStealer", "DarkGate", "exe", "Formbook", "redir-302", "xmrig", "AgentTesla", "discord", "infostealer", "1234", "7z", "Password-protected", "PDF", "TA577", "TR", "agenziaentrate", "geo", "Gozi", "ITA", "ursnif", "RedLineStealer", "opendir", "GuLoader", "doc", "gating", "GootLoader", "ISFB", "RedLine", "rat", "RemcosRAT", "docx", "Loki", "vbs", "dll", "Stealc", "aggah", "ascii", "hagga", "powershell", "ps1", "ddos", "PrivateLoader", "risepro", "SystemBC", "lnk", "Vidar", "remcos", "qbot", "Sakura", "script", "dcrat", "64-bit", "x86-64", "upx" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 68, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 663, "hostname": 36, "domain": 449 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "934 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65232828c3d7288d1ab6ebca", "name": "IOC202310090007", "description": "IP addresses are the most common type of address on the internet, but they are also the least likely to be used by people with a particular interest in their address book or email address, as well as by their own.", "modified": "2023-11-07T22:02:18.651000", "created": "2023-10-08T22:07:36.317000", "tags": [ "october", "september", "snake keylogger", "seen", "track them", "all at", "chatgpt", "change", "api quotas", "orcus rat", "danabot", "qbot", "agent tesla", "emotet", "august", "strrat", "gcleaner", "raccoon", "ficker stealer", "redline", "quasar rat", "snake", "asyncrat", "remcos", "quasar", "privateloader", "netwire", "darkcomet", "xworm", "orcus", "rats", "trojan", "redline stealer", "systembc", "malware", "wannacry", "houdini", "qakbot", "azorult", "powershell", "agenttesla", "bladabindi", "discord", "april", "first", "njrat", "smokeloader", "smoke loader", "inst", "ukraine", "fallout", "teamviewer", "cobaltstrike", "hworm", "formbook", "macos", "predator", "february", "rust", "vidar", "icedid", "pony", "eternalblue", "desktop", "mars", "adwind", "crimson rat", "trickbot", "cobalt strike", "flawedammyy", "crypto", "dcrat", "racealer", "belarus", "open", "ursnif", "hawkeye", "gootkit", "hancitor", "apart", "ryuk", "egregor", "dunihi", "jenxcus", "xtremerat", "poisonivy", "nanocore", "pinkslipbot", "path", "screen", "email", "tesla", "wannycry", "microsoft", "oski", "arkei", "ryuk", "wsh", "matiex", "remote access", "wshrat", "any.run", "ficker" ], "references": [], "public": 1, "adversary": "Email", "targeted_countries": [ "Germany", "Austria", "India", "Canada", "Switzerland", "Russian Federation", "Ukraine", "Belarus", "Kazakhstan", "Kyrgyzstan", "Armenia", "Tajikistan", "Uzbekistan", "Poland", "Italy" ], "malware_families": [ { "id": "Tesla", "display_name": "Tesla", "target": null }, { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "Microsoft", "display_name": "Microsoft", "target": null }, { "id": "AsyncRAT", "display_name": "AsyncRAT", "target": null }, { "id": "Oski", "display_name": "Oski", "target": null }, { "id": "Arkei", "display_name": "Arkei", "target": null }, { "id": "SmokeLoader", "display_name": "SmokeLoader", "target": null }, { "id": "XWorm", "display_name": "XWorm", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "FlawedAmmyy", "display_name": "FlawedAmmyy", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "PrivateLoader", "display_name": "PrivateLoader", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "Azorult", "display_name": "Azorult", "target": null }, { "id": "Email", "display_name": "Email", "target": null }, { "id": "Ryuk", "display_name": "Ryuk", "target": null }, { "id": "Houdini", "display_name": "Houdini", "target": null }, { "id": "WSH", "display_name": "WSH", "target": null }, { "id": "Hancitor", "display_name": "Hancitor", "target": null }, { "id": "Matiex", "display_name": "Matiex", "target": null }, { "id": "Vidar", "display_name": "Vidar", "target": null }, { "id": "NJRAT", "display_name": "NJRAT", "target": null }, { "id": "Bladabindi", "display_name": "Bladabindi", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "GCleaner", "display_name": "GCleaner", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "STRRAT", "display_name": "STRRAT", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Danabot", "display_name": "Danabot", "target": null }, { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "DarkComet", "display_name": "DarkComet", "target": null }, { "id": "WSHRAT", "display_name": "WSHRAT", "target": null }, { "id": "ANY.RUN", "display_name": "ANY.RUN", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Ficker", "display_name": "Ficker", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Netwire", "display_name": "Netwire", "target": null }, { "id": "njRAT", "display_name": "njRAT", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Orcus", "display_name": "Orcus", "target": null }, { "id": "Snake", "display_name": "Snake", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1111", "name": "Two-Factor Authentication Interception", "display_name": "T1111 - Two-Factor Authentication Interception" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1072", "name": "Software Deployment Tools", "display_name": "T1072 - Software Deployment Tools" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Banking", "Healthcare", "Cryptocurrency", "Banks", "Energy", "Government", "Manufacturing", "Hospitality", "Transportation" ], "TLP": "white", "cloned_from": null, "export_count": 63, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "FileHash-MD5": 17, "FileHash-SHA1": 1, "FileHash-SHA256": 423, "URL": 152, "domain": 58, "hostname": 182 }, "indicator_count": 837, "is_author": false, "is_subscribing": null, "subscriber_count": 420, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "645d789f1dce2e8d9b7b749d", "name": "URLHaus data - 11-05-2023", "description": "", "modified": "2023-05-11T23:22:07.029000", "created": "2023-05-11T23:22:07.029000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "arm", "mirai", "exe", "njRAT", "32", "Smoke Loader", "MassLogger", "opendir", "SnakeKeylogger", "AgentTesla", "hta", "rat", "RevengeRAT", "additionalpayloads", "RaccoonStealer", "raccoonv2", "RecordBreaker", "NetSupport", "zip", "ascii", "powershell", "ps", "doc", "dcrat", "CoinMiner", "ArkeiStealer", "RedLineStealer", "Password-protected", "rar", "gafgyt", "BB27", "geofenced", "js", "Qakbot", "USA", "Quakbot", "dll", "ua-ps", "Encoded", "RemcosRAT", "encrypted", "1231", "dropped-by-PrivateLoader", "dropped-by-SmokeLoader", "1234", "7z", "qbot", "1515", "SocGholish", "AveMariaRAT", "shellscript", "sparc", "motorola", "renesas", "BlackGuard", "intel", "PowerPC", "iso", "64", "Amadey", "banker", "BRA", "downloader", "smuggling", "trojan", "GuLoader", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 911, "IPv4": 341, "domain": 265, "hostname": 10 }, "indicator_count": 1527, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6420d63082e8ecb0d23f5b86", "name": "URLHaus data - 26-03-2023", "description": "", "modified": "2023-04-25T23:00:38.583000", "created": "2023-03-26T23:33:04.177000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "arm", "exe", "Rhadamanthys", "RedLineStealer", "1234", "7z", "Password-protected", "SocGholish", "32", "bashlite", "gafgyt", "motorola", "PowerPC", "sparc", "64", "intel", "shellscript", "renesas", "dropped-by-PrivateLoader", "encrypted", "RedLine", "dll", "Stealc", "x86-32", "212-113-116-143", "cochang", "pw feiyang", "zip", "pw cochang", "Vidar", "Amadey", "PrivateLoader", "Tsunami", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 3, "hostname": 2 }, "indicator_count": 1005, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "itfolkstechnology.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "itfolkstechnology.com", "found": true, "verdict": "malicious", "url_count": 4, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://itfolkstechnology.com/01765/download/zip_pass1234.7z", "status": "offline", "threat": "malware_download", "date_added": "2023-10-10", "tags": [ "1234", "7z", "Password-protected" ] }, { "url": "https://itfolkstechnology.com/download/File_pass1234.7z", "status": "offline", "threat": "malware_download", "date_added": "2023-05-11", "tags": [ "1234", "7z", "Password-protected" ] }, { "url": "https://itfolkstechnology.com/upload/File_pass1234.7z", "status": "offline", "threat": "malware_download", "date_added": "2023-03-26", "tags": [ "1234", "7z", "Password-protected" ] }, { "url": "https://itfolkstechnology.com/wp-content/download/File_pass1234.zip", "status": "offline", "threat": "malware_download", "date_added": "2023-01-18", "tags": [ "1234", "Password-protected", "zip" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780297037.8820174 }