{ "type": "Domain", "indicator": "mkstat227.xyz", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/mkstat227.xyz", "alexa": "http://www.alexa.com/siteinfo/mkstat227.xyz", "indicator": "mkstat227.xyz", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3743483858, "indicator": "mkstat227.xyz", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "65e8dbf15332bfe9f6c3e1d4", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "This report provides an analysis of infrastructure associated with the 8Base ransomware group, which utilizes the Phobos ransomware. The group has been highly active since mid-2023, targeting a broad range of sectors and encrypting files with a .8base extension. The report details 45 domains, 22 IP addresses, and 50 malicious file samples linked to 8Base operations. Most of this infrastructure remains undetected, with low VirusTotal detection rates. There was a spike in submissions to VirusTotal in February 2024, likely following a CISA advisory warning about 8Base. The report concludes that this infrastructure remains active and should be monitored for changes that could enable proactive threat detection.", "modified": "2024-04-15T13:42:47.616000", "created": "2024-03-06T21:11:13.075000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 422, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 45 }, "indicator_count": 45, "is_author": false, "is_subscribing": null, "subscriber_count": 387043, "modified_text": "778 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f73a3f45fa88890276d", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:23.616000", "created": "2024-11-24T03:37:23.616000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "556 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f7224d433f384b935c8", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:22.551000", "created": "2024-11-24T03:37:22.551000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 20, "modified_text": "556 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670f94e03014212e19fa5a77", "name": "Malicious-Dangerous-Domain&URL-New-IOC List", "description": "By Helaly", "modified": "2024-11-15T10:01:11.688000", "created": "2024-10-16T10:26:40.893000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39659, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 80, "modified_text": "564 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6683bdd1247c16c5855518c7", "name": "Domain-URL-IP-Hash-IOC", "description": "Updated collection of malicious , malware , phishing ... etc of domain , UR , IP , Hashes", "modified": "2024-08-02T07:05:02.060000", "created": "2024-07-02T08:44:01.648000", "tags": [ "word" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 286, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 15, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 2521, "domain": 8243, "email": 7, "hostname": 2893 }, "indicator_count": 13683, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "670 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6683bdc8052a11fe921381a0", "name": "Domain-URL-IP-Hash-IOC", "description": "Updated collection of malicious , malware , phishing ... etc of domain , UR , IP , Hashes", "modified": "2024-08-01T08:02:48.060000", "created": "2024-07-02T08:43:52.203000", "tags": [ "word" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 15, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 2409, "domain": 7836, "email": 7, "hostname": 2783 }, "indicator_count": 13054, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "671 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65fb4be1edc38c6ae2f9cb4e", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "", "modified": "2024-04-05T21:01:41.579000", "created": "2024-03-20T20:49:37.556000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": "65e8dbf15332bfe9f6c3e1d4", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 188, "modified_text": "788 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6601311fe569735f391c8525", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "", "modified": "2024-04-05T21:01:41.579000", "created": "2024-03-25T08:09:03.209000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": "65fb4be1edc38c6ae2f9cb4e", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "788 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6508dde2888421af2eb32025", "name": "URLHaus data - 18-09-2023", "description": "", "modified": "2023-10-18T23:03:17.365000", "created": "2023-09-18T23:31:46.558000", "tags": [ "32-bit", "elf", "x86-32", "32", "mirai", "sparc", "renesas", "mips", "motorola", "arm", "Mozi", "hajime", "AgentTesla", "exe", "njRAT", "RedLineStealer", "PowerPC", "intel", "ascii", "Encoded", "dropped-by-PrivateLoader", "encrypted", "RedLine", "VoidRAT", "AsyncRAT", "dcrat", "Formbook", "opendir", "hta", "bitrat", "rat", "AveMariaRAT", "CoinMiner", "PythonDiscordStealer", "bat", "xworm", "lnk", "dropped-by-SmokeLoader", "Smoke Loader", "gating", "GootLoader", "SystemBC", "ArkeiStealer", "stealer", "viaSmokeLoader", "Vidar", "bashlite", "gafgyt", "RaccoonStealer", "PrivateLoader", "Xpertrat", "GuLoader", "RemcosRAT", "64-bit", "x86-64", "ddos", "64", "dll", "Stealc", "shellscript", "discord", "infostealer", "android", "apk", "IRATA", "pw-2023", "rar", "Phobos", "zgRAT", "zip", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 84, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 189, "domain": 16, "hostname": 10 }, "indicator_count": 215, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "958 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64e54b7bafaa93fc316e9a61", "name": "URLHaus data - 22-08-2023", "description": "", "modified": "2023-09-21T23:02:51.783000", "created": "2023-08-22T23:57:47.103000", "tags": [ "elf", "Mozi", "32-bit", "mips", "hajime", "AsyncRAT", "exe", "AVrecon", "botnet", "c2", "SocGholish", "mirai", "arm", "dropped-by-SmokeLoader", "RedLineStealer", "njRAT", "Agenttelsa", "AgentTesla", "LummaStealer", "Stealc", "shellscript", "32", "Loki", "opendir", "AgentTesyla", "rat", "encrypted", "GuLoader", "RemcosRAT", "dropped-by-PrivateLoader", "remcos", "RedLine", "Tsunami", "archives", "Smoke Loader", "renesas", "intel", "PowerPC", "motorola" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 252, "domain": 6, "hostname": 6 }, "indicator_count": 264, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "985 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "related": { "alienvault": { "adversary": [ "8Base" ], "malware_families": [ "Smokeloader", "Systembc" ], "industries": [] }, "other": { "adversary": [ "8Base" ], "malware_families": [ "Smokeloader", "Systembc" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "65e8dbf15332bfe9f6c3e1d4", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "This report provides an analysis of infrastructure associated with the 8Base ransomware group, which utilizes the Phobos ransomware. The group has been highly active since mid-2023, targeting a broad range of sectors and encrypting files with a .8base extension. The report details 45 domains, 22 IP addresses, and 50 malicious file samples linked to 8Base operations. Most of this infrastructure remains undetected, with low VirusTotal detection rates. There was a spike in submissions to VirusTotal in February 2024, likely following a CISA advisory warning about 8Base. The report concludes that this infrastructure remains active and should be monitored for changes that could enable proactive threat detection.", "modified": "2024-04-15T13:42:47.616000", "created": "2024-03-06T21:11:13.075000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 422, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 45 }, "indicator_count": 45, "is_author": false, "is_subscribing": null, "subscriber_count": 387043, "modified_text": "778 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f73a3f45fa88890276d", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:23.616000", "created": "2024-11-24T03:37:23.616000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "556 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f7224d433f384b935c8", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:22.551000", "created": "2024-11-24T03:37:22.551000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 20, "modified_text": "556 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670f94e03014212e19fa5a77", "name": "Malicious-Dangerous-Domain&URL-New-IOC List", "description": "By Helaly", "modified": "2024-11-15T10:01:11.688000", "created": "2024-10-16T10:26:40.893000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39659, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 80, "modified_text": "564 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6683bdd1247c16c5855518c7", "name": "Domain-URL-IP-Hash-IOC", "description": "Updated collection of malicious , malware , phishing ... etc of domain , UR , IP , Hashes", "modified": "2024-08-02T07:05:02.060000", "created": "2024-07-02T08:44:01.648000", "tags": [ "word" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 286, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 15, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 2521, "domain": 8243, "email": 7, "hostname": 2893 }, "indicator_count": 13683, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "670 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6683bdc8052a11fe921381a0", "name": "Domain-URL-IP-Hash-IOC", "description": "Updated collection of malicious , malware , phishing ... etc of domain , UR , IP , Hashes", "modified": "2024-08-01T08:02:48.060000", "created": "2024-07-02T08:43:52.203000", "tags": [ "word" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 15, "FileHash-SHA1": 1, "FileHash-SHA256": 1, "URL": 2409, "domain": 7836, "email": 7, "hostname": 2783 }, "indicator_count": 13054, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "671 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65fb4be1edc38c6ae2f9cb4e", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "", "modified": "2024-04-05T21:01:41.579000", "created": "2024-03-20T20:49:37.556000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": "65e8dbf15332bfe9f6c3e1d4", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 188, "modified_text": "788 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6601311fe569735f391c8525", "name": "Phobos Ransomware: Analysing associated infrastructure used by 8Base", "description": "", "modified": "2024-04-05T21:01:41.579000", "created": "2024-03-25T08:09:03.209000", "tags": [ "ransomware", "8base" ], "references": [ "https://medium.com/@Intel_Ops/phobos-ransomware-analysing-associated-infrastructure-used-by-8base-646560302a8d" ], "public": 1, "adversary": "8Base", "targeted_countries": [], "malware_families": [ { "id": "Smokeloader", "display_name": "Smokeloader", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" } ], "industries": [], "TLP": "white", "cloned_from": "65fb4be1edc38c6ae2f9cb4e", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "788 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6508dde2888421af2eb32025", "name": "URLHaus data - 18-09-2023", "description": "", "modified": "2023-10-18T23:03:17.365000", "created": "2023-09-18T23:31:46.558000", "tags": [ "32-bit", "elf", "x86-32", "32", "mirai", "sparc", "renesas", "mips", "motorola", "arm", "Mozi", "hajime", "AgentTesla", "exe", "njRAT", "RedLineStealer", "PowerPC", "intel", "ascii", "Encoded", "dropped-by-PrivateLoader", "encrypted", "RedLine", "VoidRAT", "AsyncRAT", "dcrat", "Formbook", "opendir", "hta", "bitrat", "rat", "AveMariaRAT", "CoinMiner", "PythonDiscordStealer", "bat", "xworm", "lnk", "dropped-by-SmokeLoader", "Smoke Loader", "gating", "GootLoader", "SystemBC", "ArkeiStealer", "stealer", "viaSmokeLoader", "Vidar", "bashlite", "gafgyt", "RaccoonStealer", "PrivateLoader", "Xpertrat", "GuLoader", "RemcosRAT", "64-bit", "x86-64", "ddos", "64", "dll", "Stealc", "shellscript", "discord", "infostealer", "android", "apk", "IRATA", "pw-2023", "rar", "Phobos", "zgRAT", "zip", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 84, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 189, "domain": 16, "hostname": 10 }, "indicator_count": 215, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "958 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64e54b7bafaa93fc316e9a61", "name": "URLHaus data - 22-08-2023", "description": "", "modified": "2023-09-21T23:02:51.783000", "created": "2023-08-22T23:57:47.103000", "tags": [ "elf", "Mozi", "32-bit", "mips", "hajime", "AsyncRAT", "exe", "AVrecon", "botnet", "c2", "SocGholish", "mirai", "arm", "dropped-by-SmokeLoader", "RedLineStealer", "njRAT", "Agenttelsa", "AgentTesla", "LummaStealer", "Stealc", "shellscript", "32", "Loki", "opendir", "AgentTesyla", "rat", "encrypted", "GuLoader", "RemcosRAT", "dropped-by-PrivateLoader", "remcos", "RedLine", "Tsunami", "archives", "Smoke Loader", "renesas", "intel", "PowerPC", "motorola" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 252, "domain": 6, "hostname": 6 }, "indicator_count": 264, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "985 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "mkstat227.xyz", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "mkstat227.xyz", "found": true, "verdict": "malicious", "url_count": 12, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://mkstat227.xyz/777/skxr65o.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-10-09", "tags": [ "dropped-by-SmokeLoader", "SystemBC" ] }, { "url": "http://mkstat227.xyz/777/mtxtBVT.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-10-09", "tags": [ "dropped-by-SmokeLoader", "Phobos" ] }, { "url": "http://mkstat227.xyz/777/skxTclh.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-09-18", "tags": [ "dropped-by-SmokeLoader", "SystemBC" ] }, { "url": "http://mkstat227.xyz/777/mtxUcwO.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-09-18", "tags": [ "dropped-by-SmokeLoader", "Phobos" ] }, { "url": "http://mkstat227.xyz/777/mtxSt15.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-09-18", "tags": [ "dropped-by-SmokeLoader", "Phobos" ] }, { "url": "http://mkstat227.xyz/777/skx88cS.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-09-18", "tags": [ "dropped-by-SmokeLoader", "SystemBC" ] }, { "url": "http://mkstat227.xyz/777/mtx5Zwi.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-08-22", "tags": [ "exe" ] }, { "url": "http://mkstat227.xyz/777/skxCsnv.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-08-22", "tags": [ "exe" ] }, { "url": "http://mkstat227.xyz/777/mtxayyj.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-08-22", "tags": [ "exe" ] }, { "url": "http://mkstat227.xyz/777/skx5fXv.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-08-22", "tags": [ "exe" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780476255.0746827 }