{ "type": "Domain", "indicator": "jacksonkatz.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/jacksonkatz.com", "alexa": "http://www.alexa.com/siteinfo/jacksonkatz.com", "indicator": "jacksonkatz.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3682125925, "indicator": "jacksonkatz.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "64a2b494ee43089072971691", "name": "TechM-Threat Intel Report - W26-2023", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-08-02T11:00:08.290000", "created": "2023-07-03T11:44:20.960000", "tags": [ "sha1 file", "name submit", "date", "qakbot", "opendir", "redline", "malware url", "tags", "formbook", "japan", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "hong kong", "vietnam", "poland", "albania", "hashes domains", "week rank", "vidar", "amadey", "remcos", "rats", "ddos", "december", "arkei", "youtube", "cvss", "cvss base", "server", "asus", "fortinet", "bumblebee", "multi", "grafana", "camaro dragon", "woocommerce", "june", "icedid", "storm", "malware", "service", "scarcruft", "attack", "exploit", "cybercrime", "multi#storm", "azure ad", "condi", "javascript" ], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "Cybercrime", "targeted_countries": [ "India", "United States of America" ], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null }, { "id": "MULTI#STORM", "display_name": "MULTI#STORM", "target": null }, { "id": "Azure AD", "display_name": "Azure AD", "target": null }, { "id": "Condi", "display_name": "Condi", "target": null }, { "id": "JavaScript", "display_name": "JavaScript", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" } ], "industries": [ "Foreign Affairs" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 67, "FileHash-SHA1": 64, "FileHash-SHA256": 150, "URL": 142, "domain": 116, "hostname": 52 }, "indicator_count": 591, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1034 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6493880f4f51d2e4eeb8a909", "name": "URLHaus data - 21-06-2023", "description": "", "modified": "2023-07-21T23:04:31.937000", "created": "2023-06-21T23:30:23.598000", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA", "32-bit", "elf", "mips", "Mozi", "exe", "njRAT", "Obama270", "TR", "zip", "BatchDropperMEMZ", "ddos-bot", "mirai", "hajime", "arm", "dropped-by-amadey", "SystemBC", "remcos", "64", "dll", "botnet", "trojan", "Tsunami", "Gozi", "ursnif", "Formbook", "ArkeiStealer", "Vidar", "ascii", "plugin", "RedLineStealer", "agenziaentrate", "ITA", "32", "PowerShellDiscordKeyLogger", "ua-ps", "Quakbot", "RTF", "AgentTesla", "PureCrypter", "Loki", "encrypted", "GuLoader", "ISFB", "dofoil", "Smoke Loader", "doc", "fabookie", "1234", "7z", "Password-protected", "dropped-by-PrivateLoader", "PrivateLoader", "RedLine", "gafgyt", "NetSupport" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 568, "domain": 94, "hostname": 11 }, "indicator_count": 673, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1045 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6492361520e56fe57e2c2870", "name": "URLHaus data - 20-06-2023", "description": "", "modified": "2023-07-20T23:00:37.991000", "created": "2023-06-20T23:28:21.809000", "tags": [ "elf", "Mozi", "32-bit", "mips", "arm", "mirai", "Adwind", "BB33", "geofenced", "js", "Qakbot", "USA", "PowerShellDiscordKeyLogger", "exe", "njRAT", "Obama269", "TR", "zip", "hajime", "AsyncRAT", "ASPXChopperWebShell", "dcrat", "7z", "remcos", "RUS", "dropped-by-PrivateLoader", "RedLineStealer", "VoidRAT", "1234", "Password-protected", "dropped-by-amadey", "Rhadamanthys", "AgentTesla", "encrypted", "RedLine", "dropped-by-SmokeLoader", "RaccoonStealer", "IRATA", "sh", "32", "64", "LaplasClipper", "CoinMiner", "motorola", "Pikabot", "gafgyt", "Quakbot", "shellscript", "Loki", "Formbook", "dll", "ua-ps", "qbot", "Tsunami" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 495, "hostname": 17 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1046 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648cf21d49a36112f5c63ad8", "name": "URLHaus data - 16-06-2023", "description": "", "modified": "2023-07-16T23:03:38.959000", "created": "2023-06-16T23:37:01.362000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "32", "exe", "remcos", "powershell", "PowerShellMeterpreterReverseTCPx64", "arm", "njRAT", "dcrat", "CoinMiner", "dropped-by-PrivateLoader", "encrypted", "ascii", "hajime", "sparc", "renesas", "intel", "bashlite", "gafgyt", "64", "ArkeiStealer", "script", "PowerPC", "motorola", "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "AsyncRAT", "CAN", "ua-msi", "ua-2", "ua-w", "UA-fenced", "ua-mozilla-777", "ua-1", "dropped-by-amadey", "RedLineStealer", "dll", "RedLine", "PrivateLoader", "GBR" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 550, "hostname": 29 }, "indicator_count": 1579, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1050 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a4d53432603c5c5a788d5", "name": "URLHaus data - 14-06-2023", "description": "", "modified": "2023-07-14T23:02:48.405000", "created": "2023-06-14T23:29:23.226000", "tags": [ "geofenced", "js", "Obama268", "Qakbot", "TR", "USA", "zip", "32-bit", "elf", "mips", "Mozi", "mirai", "arm", "dcrat", "exe", "Laplas", "LaplasClipper", "dropped-by-amadey", "dropped-by-PrivateLoader", "encrypted", "RedLine", "shellscript", "gafgyt", "x86-32", "AsyncRAT", "dll", "BB32", "ua-ps", "Amadey", "script", "Rhadamanthys", "qbot", "32", "motorola", "renesas", "intel", "ua-curl" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 631, "hostname": 21 }, "indicator_count": 1651, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ac73d79f1058f9dd4c", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:40.932000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ad626f086ff24465fb", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:41.081000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647a7abaa58ae84330f2cbdf", "name": "URLHaus data - 02-06-2023", "description": "", "modified": "2023-07-02T23:03:26.565000", "created": "2023-06-02T23:26:50.082000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "ArkeiStealer", "dropped-by-amadey", "RedLineStealer", "arm", "x86-32", "ddos-bot", "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip", "dll", "64", "exe", "zgRAT", "RemcosRAT", "Loki", "opendir", "doc", "pw-1515", "rar", "pw-2023", "pw-2022", "pw-333", "Obama266", "VoidRAT", "Quakbot", "qbot", "AgentTesla", "RTF", "encrypted", "GuLoader", "rat", "Stealc", "2022", "Password-protected", "1234", "7z", "njRAT", "shellscript", "32", "bashlite", "gafgyt", "renesas", "intel", "Rhadamanthys", "payloads", "viaSmokeLoader", "Smoke Loader", "dropped-by-PrivateLoader", "RedLine", "dcrat", "additionalpayloads", "raccoonv2", "RecordBreaker", "xworm", "Formbook" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 228, "hostname": 3 }, "indicator_count": 1230, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1065 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6477d79099035326786bca6e", "name": "URLHaus data - 31-05-2023", "description": "", "modified": "2023-06-30T23:02:10.939000", "created": "2023-05-31T23:26:08.882000", "tags": [ "elf", "Mozi", "32-bit", "mips", "mirai", "arm", "hajime", "PowerShellDiscordKeyLogger", "BB30", "geofenced", "js", "Qakbot", "USA", "zip", "dll", "Quakbot", "x86-32", "gafgyt", "exe", "Formbook", "opendir", "VoidRAT", "NetSupport", "rat", "32", "sparc", "motorola", "PowerPC", "Loki", "AgentTesla", "cutwail", "rdgn", "shellscript", "Amadey", "dropped-by-PrivateLoader", "RedLineStealer", "brt", "Gozi", "ISFB", "ITA", "ursnif", "Gh0stRAT", "ascii", "Encoded", "encrypted" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 399, "hostname": 7 }, "indicator_count": 1406, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6476857e1d456831af861636", "name": "URLHaus data - 30-05-2023", "description": "", "modified": "2023-06-29T23:00:59.158000", "created": "2023-05-30T23:23:42.146000", "tags": [ "32-bit", "arm", "elf", "Mozi", "hajime", "mips", "mirai", "geofenced", "js", "Obama265", "Qakbot", "USA", "zip", "BB30", "dll", "msi", "dropped-by-amadey", "exe", "njRAT", "Raccoon", "stealer", "third-party dll", "BatchDropperMEMZ", "ua-ps", "PHPWebShellMiniShell", "2022", "Password-protected", "CobaltStrike", "golang", "stager", "VoidRAT", "64", "Arechclient2", "CoinMiner", "dropped-by-PrivateLoader", "xmrig", "RedLineStealer", "AsyncRAT", "powershell", "rat", "encrypted", "PrivateLoader", "qbot", "ITA", "Quakbot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 609 }, "indicator_count": 1613, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646bf96a09aa71a1bd60fce5", "name": "URLHaus data - 22-05-2023", "description": "", "modified": "2023-06-23T22:19:18.469000", "created": "2023-05-22T23:23:22.337000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "32", "exe", "lucifer", "geofenced", "js", "Pikabot", "Qakbot", "USA", "dropped-by-PrivateLoader", "njRAT", "64", "hajime", "dll", "ua-ps", "dropped-by-SmokeLoader", "PowerPC", "intel", "renesas", "shellscript", "motorola", "sparc", "Stealc", "encrypted", "RedLine", "rat", "AgentTesla", "RecordBreaker", "NanoCore", "opendir", "ascii", "Encoded", "GuLoader", "QuasarRAT", "1234", "7z", "Password-protected", "CoinMiner", "Lumma", "LummaStealer", "pw-2023", "rar", "pw-2022", "pw-123", "xworm", "qbot", "Formbook", "RemcosRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 820, "domain": 345, "hostname": 4 }, "indicator_count": 1169, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1073 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6466b35675126d41269a7e39", "name": "URLHaus data - 18-05-2023", "description": "", "modified": "2023-06-23T22:14:17.716000", "created": "2023-05-18T23:23:02.123000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "x86-32", "32", "exe", "RedLineStealer", "64-bit", "x86-64", "hajime", "ddos-bot", "BB28", "geofenced", "js", "Qakbot", "USA", "njRAT", "ua-ps", "1234", "7z", "Password-protected", "dropped-by-SmokeLoader", "dropped-by-PrivateLoader", "encrypted", "RedLine", "Amadey", "RTF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 611, "domain": 221 }, "indicator_count": 832, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1073 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "https://www.spamhaus.org/xbl/", "https://urlhaus.abuse.ch/browse/", "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Cybercrime" ], "malware_families": [ "Icedid", "Multi#storm", "Condi", "Qakbot", "Azure ad", "Javascript" ], "industries": [ "Foreign affairs" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "64a2b494ee43089072971691", "name": "TechM-Threat Intel Report - W26-2023", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-08-02T11:00:08.290000", "created": "2023-07-03T11:44:20.960000", "tags": [ "sha1 file", "name submit", "date", "qakbot", "opendir", "redline", "malware url", "tags", "formbook", "japan", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "hong kong", "vietnam", "poland", "albania", "hashes domains", "week rank", "vidar", "amadey", "remcos", "rats", "ddos", "december", "arkei", "youtube", "cvss", "cvss base", "server", "asus", "fortinet", "bumblebee", "multi", "grafana", "camaro dragon", "woocommerce", "june", "icedid", "storm", "malware", "service", "scarcruft", "attack", "exploit", "cybercrime", "multi#storm", "azure ad", "condi", "javascript" ], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "Cybercrime", "targeted_countries": [ "India", "United States of America" ], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null }, { "id": "MULTI#STORM", "display_name": "MULTI#STORM", "target": null }, { "id": "Azure AD", "display_name": "Azure AD", "target": null }, { "id": "Condi", "display_name": "Condi", "target": null }, { "id": "JavaScript", "display_name": "JavaScript", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" } ], "industries": [ "Foreign Affairs" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 67, "FileHash-SHA1": 64, "FileHash-SHA256": 150, "URL": 142, "domain": 116, "hostname": 52 }, "indicator_count": 591, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1034 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6493880f4f51d2e4eeb8a909", "name": "URLHaus data - 21-06-2023", "description": "", "modified": "2023-07-21T23:04:31.937000", "created": "2023-06-21T23:30:23.598000", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA", "32-bit", "elf", "mips", "Mozi", "exe", "njRAT", "Obama270", "TR", "zip", "BatchDropperMEMZ", "ddos-bot", "mirai", "hajime", "arm", "dropped-by-amadey", "SystemBC", "remcos", "64", "dll", "botnet", "trojan", "Tsunami", "Gozi", "ursnif", "Formbook", "ArkeiStealer", "Vidar", "ascii", "plugin", "RedLineStealer", "agenziaentrate", "ITA", "32", "PowerShellDiscordKeyLogger", "ua-ps", "Quakbot", "RTF", "AgentTesla", "PureCrypter", "Loki", "encrypted", "GuLoader", "ISFB", "dofoil", "Smoke Loader", "doc", "fabookie", "1234", "7z", "Password-protected", "dropped-by-PrivateLoader", "PrivateLoader", "RedLine", "gafgyt", "NetSupport" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 568, "domain": 94, "hostname": 11 }, "indicator_count": 673, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1045 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6492361520e56fe57e2c2870", "name": "URLHaus data - 20-06-2023", "description": "", "modified": "2023-07-20T23:00:37.991000", "created": "2023-06-20T23:28:21.809000", "tags": [ "elf", "Mozi", "32-bit", "mips", "arm", "mirai", "Adwind", "BB33", "geofenced", "js", "Qakbot", "USA", "PowerShellDiscordKeyLogger", "exe", "njRAT", "Obama269", "TR", "zip", "hajime", "AsyncRAT", "ASPXChopperWebShell", "dcrat", "7z", "remcos", "RUS", "dropped-by-PrivateLoader", "RedLineStealer", "VoidRAT", "1234", "Password-protected", "dropped-by-amadey", "Rhadamanthys", "AgentTesla", "encrypted", "RedLine", "dropped-by-SmokeLoader", "RaccoonStealer", "IRATA", "sh", "32", "64", "LaplasClipper", "CoinMiner", "motorola", "Pikabot", "gafgyt", "Quakbot", "shellscript", "Loki", "Formbook", "dll", "ua-ps", "qbot", "Tsunami" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 495, "hostname": 17 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "1046 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648cf21d49a36112f5c63ad8", "name": "URLHaus data - 16-06-2023", "description": "", "modified": "2023-07-16T23:03:38.959000", "created": "2023-06-16T23:37:01.362000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "32", "exe", "remcos", "powershell", "PowerShellMeterpreterReverseTCPx64", "arm", "njRAT", "dcrat", "CoinMiner", "dropped-by-PrivateLoader", "encrypted", "ascii", "hajime", "sparc", "renesas", "intel", "bashlite", "gafgyt", "64", "ArkeiStealer", "script", "PowerPC", "motorola", "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "AsyncRAT", "CAN", "ua-msi", "ua-2", "ua-w", "UA-fenced", "ua-mozilla-777", "ua-1", "dropped-by-amadey", "RedLineStealer", "dll", "RedLine", "PrivateLoader", "GBR" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 550, "hostname": 29 }, "indicator_count": 1579, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1050 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a4d53432603c5c5a788d5", "name": "URLHaus data - 14-06-2023", "description": "", "modified": "2023-07-14T23:02:48.405000", "created": "2023-06-14T23:29:23.226000", "tags": [ "geofenced", "js", "Obama268", "Qakbot", "TR", "USA", "zip", "32-bit", "elf", "mips", "Mozi", "mirai", "arm", "dcrat", "exe", "Laplas", "LaplasClipper", "dropped-by-amadey", "dropped-by-PrivateLoader", "encrypted", "RedLine", "shellscript", "gafgyt", "x86-32", "AsyncRAT", "dll", "BB32", "ua-ps", "Amadey", "script", "Rhadamanthys", "qbot", "32", "motorola", "renesas", "intel", "ua-curl" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 631, "hostname": 21 }, "indicator_count": 1651, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ac73d79f1058f9dd4c", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:40.932000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "648a05ad626f086ff24465fb", "name": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23", "description": "Qakbot IOCs - @pr0xylife - BB32- 6/14/23\nhttps://twitter.com/Cryptolaemus1/status/1668965414867443712\nBB32 - url > .zip > .js > curl > .dll\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt", "modified": "2023-07-14T17:02:59.200000", "created": "2023-06-14T18:23:41.081000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB32_14.06.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 18, "domain": 345, "hostname": 6 }, "indicator_count": 842, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "1052 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647a7abaa58ae84330f2cbdf", "name": "URLHaus data - 02-06-2023", "description": "", "modified": "2023-07-02T23:03:26.565000", "created": "2023-06-02T23:26:50.082000", "tags": [ "32-bit", "elf", "mips", "Mozi", "hajime", "mirai", "ArkeiStealer", "dropped-by-amadey", "RedLineStealer", "arm", "x86-32", "ddos-bot", "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip", "dll", "64", "exe", "zgRAT", "RemcosRAT", "Loki", "opendir", "doc", "pw-1515", "rar", "pw-2023", "pw-2022", "pw-333", "Obama266", "VoidRAT", "Quakbot", "qbot", "AgentTesla", "RTF", "encrypted", "GuLoader", "rat", "Stealc", "2022", "Password-protected", "1234", "7z", "njRAT", "shellscript", "32", "bashlite", "gafgyt", "renesas", "intel", "Rhadamanthys", "payloads", "viaSmokeLoader", "Smoke Loader", "dropped-by-PrivateLoader", "RedLine", "dcrat", "additionalpayloads", "raccoonv2", "RecordBreaker", "xworm", "Formbook" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 999, "domain": 228, "hostname": 3 }, "indicator_count": 1230, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1064 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64792983937e13c07e705c69", "name": "URLHaus data - 01-06-2023", "description": "", "modified": "2023-07-02T01:10:08.236000", "created": "2023-06-01T23:28:03.934000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "geofenced", "js", "Obama266", "Qakbot", "USA", "zip", "hajime", "32", "intel", "BatchDropperMEMZ", "sparc", "renesas", "64", "motorola", "PowerPC", "AgentTesla", "opendir", "doc", "Loki", "zgRAT", "NetSupport", "rat", "script", "exe", "RemcosRAT", "2022", "Password-protected", "rar", "dll", "RecordBreaker", "dotm", "geo", "KOR", "lockbit", "Ransomware", "GBR", "x86-32", "remcos", "BB30", "Quakbot", "Stealc", "shellscript", "dropped-by-SmokeLoader", "LaplasClipper", "msi", "ua-msi", "upx", "QuasarRAT", "PowerShellDiscordVoiceLogger", "RedLineStealer", "Formbook", "SnakeKeylogger", "PowerShellDiscordScreenStealer", "AsyncRAT", "PowerShellDiscordKeyLogger", "VoidRAT", "GuLoader", "bashlite", "gafgyt", "AZORult", "gcleaner", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "PrivateLoader", "xworm", "RedLine", "AnyDesk", "SectopRAT", "AveMariaRAT" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 160, "hostname": 4 }, "indicator_count": 1164, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1065 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6477d79099035326786bca6e", "name": "URLHaus data - 31-05-2023", "description": "", "modified": "2023-06-30T23:02:10.939000", "created": "2023-05-31T23:26:08.882000", "tags": [ "elf", "Mozi", "32-bit", "mips", "mirai", "arm", "hajime", "PowerShellDiscordKeyLogger", "BB30", "geofenced", "js", "Qakbot", "USA", "zip", "dll", "Quakbot", "x86-32", "gafgyt", "exe", "Formbook", "opendir", "VoidRAT", "NetSupport", "rat", "32", "sparc", "motorola", "PowerPC", "Loki", "AgentTesla", "cutwail", "rdgn", "shellscript", "Amadey", "dropped-by-PrivateLoader", "RedLineStealer", "brt", "Gozi", "ISFB", "ITA", "ursnif", "Gh0stRAT", "ascii", "Encoded", "encrypted" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 399, "hostname": 7 }, "indicator_count": 1406, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "jacksonkatz.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "jacksonkatz.com", "found": true, "verdict": "malicious", "url_count": 10, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://jacksonkatz.com/nou/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-21", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA" ] }, { "url": "https://jacksonkatz.com/esdm/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-20", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA" ] }, { "url": "https://jacksonkatz.com/es/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-16", "tags": [ "BB32", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA" ] }, { "url": "https://jacksonkatz.com/mol/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-14", "tags": [ "BB32", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://jacksonkatz.com/pqso/", "status": "offline", "threat": "malware_download", "date_added": "2023-06-02", "tags": [ "BB30", "geofenced", "js", "Qakbot", "TR", "USA", "zip" ] }, { "url": "https://jacksonkatz.com/erso/", "status": "offline", "threat": "malware_download", "date_added": "2023-06-01", "tags": [ "BB30", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://jacksonkatz.com/uu/", "status": "offline", "threat": "malware_download", "date_added": "2023-05-31", "tags": [ "BB30", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://jacksonkatz.com/en/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-30", "tags": [ "BB30", "geofenced", "js", "Qakbot", "Quakbot", "USA", "zip" ] }, { "url": "https://jacksonkatz.com/iauu/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-22", "tags": [ "geofenced", "js", "Pikabot", "Qakbot", "Quakbot", "USA" ] }, { "url": "https://jacksonkatz.com/dia/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-18", "tags": [ "BB28", "geofenced", "js", "Qakbot", "USA" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780319863.3115168 }