{ "type": "Domain", "indicator": "milleniuninformatica.com.br", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/milleniuninformatica.com.br", "alexa": "http://www.alexa.com/siteinfo/milleniuninformatica.com.br", "indicator": "milleniuninformatica.com.br", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3658846387, "indicator": "milleniuninformatica.com.br", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "645b513c74a057052c0a4685", "name": "\u8457\u540d\u52d2\u7d22\u524d\u7f6e\u8f6f\u4ef6Qbot\u5f00\u542f\u65b0\u4e00\u8f6e\u5783\u573e\u90ae\u4ef6\u6295\u9012\u6d3b\u52a8", "description": "2023 \u5e74 4 \u6708 7 \u65e5\uff0c AhnLab\u5b89\u5168\u7d27\u6025\u54cd\u5e94\u4e2d\u5fc3 (ASEC) \u53d1\u73b0\u4f7f\u7528\u7535\u5b50\u90ae\u4ef6\u9644\u52a0\u6076\u610f PDF \u6587\u4ef6\u5206\u53d1 Qakbot \u6076\u610f\u8f6f\u4ef6\u7684\u653b\u51fb\u6d3b\u52a8\u3002\u90ae\u4ef6\u9644\u4ef6\u4e2d\u7684PDF\u6587\u4ef6\u540d\u662f'UT.PDF'\u3001'RA.PDF'\u3001'NM.PDF'\u662f\u81ea\u52a8\u751f\u6210\u7684\u968f\u673a\u5b57\u7b26\u5f62\u5f0f\uff0c\u5355\u51fb\u6253\u5f00\u6309\u94ae\u4f1a\u94fe\u63a5\u5230\u6076\u610f URL\uff0c\u5982\u679c\u8be5 URL \u53ef\u8bbf\u95ee\uff0c\u5219\u4f1a\u4e0b\u8f7d\u52a0\u5bc6\u7684\u538b\u7f29 ZIP \u6587\u4ef6\uff0c\u6267\u884c\u540e\u7eed\u6076\u610f\u64cd\u4f5c\u3002\u7531\u4e8e\u8bb8\u591a\u6076\u610f\u7535\u5b50\u90ae\u4ef6\u90fd\u4ee5\u7c7b\u4f3c\u7684\u683c\u5f0f\u5206\u53d1\uff0c\u56e0\u6b64\u5efa\u8bae\u60a8\u9605\u8bfb\u53c2\u8003\u94fe\u63a5\u4e0d\u660e\u7684\u7535\u5b50\u90ae\u4ef6\u65f6\u8981\u5c0f\u5fc3\u3002", "modified": "2023-06-14T02:41:54.900000", "created": "2023-05-10T08:09:32.274000", "tags": [ "qakbot", "asec", "antivirus", "girnie", "ahnlab security", "center", "microsoft", "azure", "open", "password", "HotSpot" ], "references": [ "https://asec.ahnlab.com/ko/51109/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qbot", "display_name": "Qbot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "junchuanyang1", "id": "157561", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157561/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "URL": 10, "domain": 10 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 87, "modified_text": "1082 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64303fbe1a800c070308f42d", "name": "Qakbot IOCs - @cryptolaemus 4/6/23 - BB22", "description": "Qakbot IOCs - @cryptolaemus 4/6/23 - BB22\nhttps://twitter.com/Cryptolaemus1/status/1643943604962971649\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB22_06.04.2023.txt", "modified": "2023-05-07T16:03:58.331000", "created": "2023-04-07T16:07:26.465000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB22_06.04.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 150, "FileHash-SHA1": 2, "FileHash-SHA256": 18, "domain": 32 }, "indicator_count": 202, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642f53befef97c2420b4be1b", "name": "URLHaus data - 06-04-2023", "description": "", "modified": "2023-05-06T23:02:18.562000", "created": "2023-04-06T23:20:30.008000", "tags": [ "32-bit", "elf", "mips", "Mozi", "32", "exe", "nitol", "mirai", "arm", "njRAT", "hajime", "geofenced", "obama249", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "vjw0rm", "dll", "ua-ps", "BB22", "755", "js", "TR", "xworm", "Stealc", "gafgyt" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 462, "hostname": 50 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643997edaed7f9b5fa88575c", "name": "Qakbot Being Distributed in Korea Through Email Hijacking", "description": "", "modified": "2023-04-14T18:14:05.623000", "created": "2023-04-14T18:14:05.623000", "tags": [ "pdf attachment", "pdf file", "asec", "qakbot", "open button", "zip file", "wsf file", "qakbot binary", "girnie", "ahnlab", "screen" ], "references": [ "https://asec.ahnlab.com/en/51282/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": "6437e56703ba84fbfdec41ff", "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 10, "domain": 10 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "1142 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6437e56703ba84fbfdec41ff", "name": "Qakbot Being Distributed in Korea Through Email Hijacking - ASEC BLOG", "description": "A security emergency response centre in South Korea has identified how Qakbot banking malware is being distributed through email hijacked emails, and how the malicious code is used to bypass antivirus software and bypass detection.", "modified": "2023-04-13T11:20:07.780000", "created": "2023-04-13T11:20:07.780000", "tags": [ "pdf attachment", "pdf file", "asec", "qakbot", "open button", "zip file", "wsf file", "qakbot binary", "girnie", "ahnlab", "screen" ], "references": [ "https://asec.ahnlab.com/en/51282/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 10, "domain": 10 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "1144 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://asec.ahnlab.com/en/51282/", "https://urlhaus.abuse.ch/browse/", "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB22_06.04.2023.txt", "https://asec.ahnlab.com/ko/51109/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Qbot", "Qakbot" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "645b513c74a057052c0a4685", "name": "\u8457\u540d\u52d2\u7d22\u524d\u7f6e\u8f6f\u4ef6Qbot\u5f00\u542f\u65b0\u4e00\u8f6e\u5783\u573e\u90ae\u4ef6\u6295\u9012\u6d3b\u52a8", "description": "2023 \u5e74 4 \u6708 7 \u65e5\uff0c AhnLab\u5b89\u5168\u7d27\u6025\u54cd\u5e94\u4e2d\u5fc3 (ASEC) \u53d1\u73b0\u4f7f\u7528\u7535\u5b50\u90ae\u4ef6\u9644\u52a0\u6076\u610f PDF \u6587\u4ef6\u5206\u53d1 Qakbot \u6076\u610f\u8f6f\u4ef6\u7684\u653b\u51fb\u6d3b\u52a8\u3002\u90ae\u4ef6\u9644\u4ef6\u4e2d\u7684PDF\u6587\u4ef6\u540d\u662f'UT.PDF'\u3001'RA.PDF'\u3001'NM.PDF'\u662f\u81ea\u52a8\u751f\u6210\u7684\u968f\u673a\u5b57\u7b26\u5f62\u5f0f\uff0c\u5355\u51fb\u6253\u5f00\u6309\u94ae\u4f1a\u94fe\u63a5\u5230\u6076\u610f URL\uff0c\u5982\u679c\u8be5 URL \u53ef\u8bbf\u95ee\uff0c\u5219\u4f1a\u4e0b\u8f7d\u52a0\u5bc6\u7684\u538b\u7f29 ZIP \u6587\u4ef6\uff0c\u6267\u884c\u540e\u7eed\u6076\u610f\u64cd\u4f5c\u3002\u7531\u4e8e\u8bb8\u591a\u6076\u610f\u7535\u5b50\u90ae\u4ef6\u90fd\u4ee5\u7c7b\u4f3c\u7684\u683c\u5f0f\u5206\u53d1\uff0c\u56e0\u6b64\u5efa\u8bae\u60a8\u9605\u8bfb\u53c2\u8003\u94fe\u63a5\u4e0d\u660e\u7684\u7535\u5b50\u90ae\u4ef6\u65f6\u8981\u5c0f\u5fc3\u3002", "modified": "2023-06-14T02:41:54.900000", "created": "2023-05-10T08:09:32.274000", "tags": [ "qakbot", "asec", "antivirus", "girnie", "ahnlab security", "center", "microsoft", "azure", "open", "password", "HotSpot" ], "references": [ "https://asec.ahnlab.com/ko/51109/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qbot", "display_name": "Qbot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "junchuanyang1", "id": "157561", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157561/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "URL": 10, "domain": 10 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 87, "modified_text": "1082 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64303fbe1a800c070308f42d", "name": "Qakbot IOCs - @cryptolaemus 4/6/23 - BB22", "description": "Qakbot IOCs - @cryptolaemus 4/6/23 - BB22\nhttps://twitter.com/Cryptolaemus1/status/1643943604962971649\nhttps://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB22_06.04.2023.txt", "modified": "2023-05-07T16:03:58.331000", "created": "2023-04-07T16:07:26.465000", "tags": [ "qakbot" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB22_06.04.2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "QakBot", "display_name": "QakBot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Techronik", "id": "114546", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 150, "FileHash-SHA1": 2, "FileHash-SHA256": 18, "domain": 32 }, "indicator_count": 202, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "1119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642f53befef97c2420b4be1b", "name": "URLHaus data - 06-04-2023", "description": "", "modified": "2023-05-06T23:02:18.562000", "created": "2023-04-06T23:20:30.008000", "tags": [ "32-bit", "elf", "mips", "Mozi", "32", "exe", "nitol", "mirai", "arm", "njRAT", "hajime", "geofenced", "obama249", "Qakbot", "qbot", "Quakbot", "USA", "wsf", "zip", "vjw0rm", "dll", "ua-ps", "BB22", "755", "js", "TR", "xworm", "Stealc", "gafgyt" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 462, "hostname": 50 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643997edaed7f9b5fa88575c", "name": "Qakbot Being Distributed in Korea Through Email Hijacking", "description": "", "modified": "2023-04-14T18:14:05.623000", "created": "2023-04-14T18:14:05.623000", "tags": [ "pdf attachment", "pdf file", "asec", "qakbot", "open button", "zip file", "wsf file", "qakbot binary", "girnie", "ahnlab", "screen" ], "references": [ "https://asec.ahnlab.com/en/51282/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": "6437e56703ba84fbfdec41ff", "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 10, "domain": 10 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "1142 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6437e56703ba84fbfdec41ff", "name": "Qakbot Being Distributed in Korea Through Email Hijacking - ASEC BLOG", "description": "A security emergency response centre in South Korea has identified how Qakbot banking malware is being distributed through email hijacked emails, and how the malicious code is used to bypass antivirus software and bypass detection.", "modified": "2023-04-13T11:20:07.780000", "created": "2023-04-13T11:20:07.780000", "tags": [ "pdf attachment", "pdf file", "asec", "qakbot", "open button", "zip file", "wsf file", "qakbot binary", "girnie", "ahnlab", "screen" ], "references": [ "https://asec.ahnlab.com/en/51282/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 10, "domain": 10 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "1144 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "milleniuninformatica.com.br", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "milleniuninformatica.com.br", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://milleniuninformatica.com.br/Le9/", "status": "offline", "threat": "malware_download", "date_added": "2023-04-06", "tags": [ "BB22", "dll", "geofenced", "Qakbot", "Quakbot", "ua-ps", "USA" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780241016.104007 }