{
  "type": "Domain",
  "indicator": "plengreg.fun",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/plengreg.fun",
    "alexa": "http://www.alexa.com/siteinfo/plengreg.fun",
    "indicator": "plengreg.fun",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3786699967,
      "indicator": "plengreg.fun",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "691b8869e00b107fa20d9482",
          "name": "ThreatFix",
          "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
          "modified": "2026-01-23T11:01:07.175000",
          "created": "2025-11-17T20:41:11.797000",
          "tags": [
            "",
            "ransomware",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "zlepos384",
            "id": "103244",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 8010,
            "FileHash-SHA1": 7922,
            "FileHash-SHA256": 8893,
            "URL": 57004,
            "domain": 36018,
            "hostname": 96473
          },
          "indicator_count": 214320,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 44,
          "modified_text": "127 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "691a02d238fcc3cdca917f79",
          "name": "Top 10 Malware Q3 2025",
          "description": "In the third quarter of 2025, the frequency of malware notifications rose by 38%, indicating an escalating cyber threat landscape. Notably, SocGholish remained the most prevalent malware, accounting for 26% of detections. It functions as a downloader, primarily written in JavaScript, and is disseminated through malicious websites that impersonate legitimate browser updates. Infections from SocGholish can result in further exploitation, including the deployment of remote access tools (RATs) like NetSupport and AsyncRAT. The Multi-State Information Sharing and Analysis Center (MS-ISAC) identifies three primary initial infection vectors for the top malware: Dropped, Malspam, and Malvertisement, with some malware exhibiting multiple infection methods depending on their context.",
          "modified": "2025-11-16T16:58:58.497000",
          "created": "2025-11-16T16:58:58.497000",
          "tags": [
            "lumma stealer",
            "sha256 hashes",
            "malware",
            "jinupd",
            "coinminer",
            "agent tesla",
            "cis cti",
            "msisac",
            "javascript",
            "netsupport",
            "gh0st",
            "telegrab",
            "venomrat",
            "asyncrat",
            "malspam",
            "nanocore",
            "cobalt strike",
            "telegram",
            "service",
            "jackpos",
            "leverage",
            "local",
            "zphp",
            "socgholish",
            "lumma"
          ],
          "references": [
            "https://www.cisecurity.org/insights/blog/top-10-malware-q3-2025"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Jinupd",
              "display_name": "Jinupd",
              "target": null
            },
            {
              "id": "Malspam",
              "display_name": "Malspam",
              "target": null
            },
            {
              "id": "VenomRat",
              "display_name": "VenomRat",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "ZPHP",
              "display_name": "ZPHP",
              "target": null
            },
            {
              "id": "SocGholish",
              "display_name": "SocGholish",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 33,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 49,
            "domain": 17,
            "hostname": 12
          },
          "indicator_count": 144,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "195 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6564dbf69e671f17f456ebe7",
          "name": "officeaddons.com",
          "description": "",
          "modified": "2025-06-04T17:22:01.994000",
          "created": "2023-11-27T18:12:05.989000",
          "tags": [
            "DPRK"
          ],
          "references": [
            "https://www.virustotal.com/graph/g86e7fd92613f491a8809ed2c0d5a4c0f19da965b3fde4d82ada88a957b138b68"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 27,
            "FileHash-SHA1": 27,
            "FileHash-SHA256": 165,
            "domain": 181,
            "hostname": 10
          },
          "indicator_count": 410,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "360 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67617edafa11fa408b73322c",
          "name": "ACTIVIDAD MALICIOSA | Relacionada con Lumma Stealer 17-12-2024",
          "description": "Lumma Stealer es un tipo de software malicioso dise\u00f1ado para robar informaci\u00f3n confidencial de los dispositivos infectados. Este malware se infiltra en los sistemas y extrae datos personales, como nombres de usuario, contrase\u00f1as, informaci\u00f3n bancaria y detalles de tarjetas de cr\u00e9dito. LummaStealer puede afectar varias cuentas, incluidas redes sociales, correos electr\u00f3nicos y monederos de criptomonedas. Los delincuentes pueden usar la informaci\u00f3n robada para chantaje, suplantaci\u00f3n de identidad, y realizar transacciones fraudulentas, lo que puede causar serios problemas de privacidad y p\u00e9rdidas econ\u00f3micas significativas para las v\u00edctimas.",
          "modified": "2025-01-16T13:03:38.406000",
          "created": "2024-12-17T13:38:34.760000",
          "tags": [
            "access",
            "discovery",
            "ta0001 initial",
            "t1003 data",
            "local system",
            "t1033 system",
            "t1057 process",
            "t1082 system",
            "t1087 account"
          ],
          "references": [
            "https://darfe.es/ciberwiki/index.php?title=Lumma",
            "https://www.virustotal.com/graph/embed/gec57b97e0f194fd38738be6392abba6f180fe9d93be24891af76fb2c7bec3638?theme=dark",
            "https://www.virustotal.com/gui/collection/bf70caf191025dfa3e68e8bc63882880ae2ca60f72ece512aaee246b487c5ad6"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "esoporteingenieria2020",
            "id": "121604",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 26,
            "FileHash-SHA1": 25,
            "FileHash-SHA256": 27,
            "URL": 301,
            "domain": 665,
            "hostname": 8
          },
          "indicator_count": 1052,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 267,
          "modified_text": "499 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "674c9f48cd2a512e28ef6523",
          "name": "ACTIVIDAD MALICIOSA | Relacionada con LummaStealer 01-12-2024",
          "description": "Lumma Stealer es un tipo de software malicioso dise\u00f1ado para robar informaci\u00f3n confidencial de los dispositivos infectados. Este malware se infiltra en los sistemas y extrae datos personales, como nombres de usuario, contrase\u00f1as, informaci\u00f3n bancaria y detalles de tarjetas de cr\u00e9dito. LummaStealer puede afectar varias cuentas, incluidas redes sociales, correos electr\u00f3nicos y monederos de criptomonedas. Los delincuentes pueden usar la informaci\u00f3n robada para chantaje, suplantaci\u00f3n de identidad, y realizar transacciones fraudulentas, lo que puede causar serios problemas de privacidad y p\u00e9rdidas econ\u00f3micas significativas para las v\u00edctimas.",
          "modified": "2024-12-31T17:05:00.863000",
          "created": "2024-12-01T17:39:20.573000",
          "tags": [
            "http",
            "access",
            "discovery",
            "uexfvbqog9i67m",
            "mmirygls1g",
            "vt51x7b9cwn7e4x",
            "v2fnqdfylkobc",
            "tcticas",
            "ta0001 initial",
            "t1003 data"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/g31920c46027f42a085f0a4040c4609fcccba0ba580b3451893964f393d84ac65?theme=dark",
            "https://www.virustotal.com/gui/collection/9419ada66b99877877ab2cbbe22a5e2de65cd18153db39736cb4fe1d06cc1129",
            "https://darfe.es/ciberwiki/index.php?title=Lumma"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "esoporteingenieria2020",
            "id": "121604",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1161,
            "FileHash-SHA1": 1159,
            "FileHash-SHA256": 1167,
            "URL": 255,
            "domain": 665,
            "hostname": 8
          },
          "indicator_count": 4415,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 266,
          "modified_text": "515 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "656da1f1f7134027660ccba0",
          "name": "Summary of the activities of the group UAC-0006 as of 01.12.2023",
          "description": "The full text of the full report on the events of 7 July 2017:..-. and the details will appear on BBC Radio 5 live on Monday, 7 September. (19:00 BST).",
          "modified": "2024-01-03T09:00:33.796000",
          "created": "2023-12-04T09:54:57.524000",
          "tags": [],
          "references": [
            "https://cert.gov.ua/article/6276584"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunter_NL",
            "id": "171283",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 93,
            "FileHash-SHA1": 14,
            "FileHash-SHA256": 93,
            "domain": 25,
            "URL": 30,
            "hostname": 1
          },
          "indicator_count": 256,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 862,
          "modified_text": "878 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fba950960704911232093",
          "name": "\u8fd1\u671fUTG-Q-003 \u7ec4\u7ec7\u653b\u51fb\u4e8b\u4ef6",
          "description": "\u8fd1\u671f\uff0c\u5a01\u80c1\u7814\u7a76\u4eba\u5458\u8ffd\u8e2a\u5230 UTG-Q-003 \u7ec4\u7ec7\u653b\u51fb\u4e8b\u4ef6",
          "modified": "2023-12-18T03:21:49.323000",
          "created": "2023-12-18T03:20:53.524000",
          "tags": [
            "HotSpot"
          ],
          "references": [
            ""
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "leiwen15",
            "id": "157128",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 20,
            "hostname": 16
          },
          "indicator_count": 36,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 42,
          "modified_text": "895 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://darfe.es/ciberwiki/index.php?title=Lumma",
        "https://cert.gov.ua/article/6276584",
        "https://www.virustotal.com/graph/g86e7fd92613f491a8809ed2c0d5a4c0f19da965b3fde4d82ada88a957b138b68",
        "https://www.cisecurity.org/insights/blog/top-10-malware-q3-2025",
        "https://www.virustotal.com/graph/embed/g31920c46027f42a085f0a4040c4609fcccba0ba580b3451893964f393d84ac65?theme=dark",
        "https://www.virustotal.com/gui/collection/9419ada66b99877877ab2cbbe22a5e2de65cd18153db39736cb4fe1d06cc1129",
        "https://www.virustotal.com/graph/embed/gec57b97e0f194fd38738be6392abba6f180fe9d93be24891af76fb2c7bec3638?theme=dark",
        "https://www.virustotal.com/gui/collection/bf70caf191025dfa3e68e8bc63882880ae2ca60f72ece512aaee246b487c5ad6"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "",
            "Venomrat",
            "Socgholish",
            "Lumma stealer",
            "Malspam",
            "Zphp",
            "Jinupd",
            "Cobalt strike",
            "Lumma"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "691b8869e00b107fa20d9482",
      "name": "ThreatFix",
      "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
      "modified": "2026-01-23T11:01:07.175000",
      "created": "2025-11-17T20:41:11.797000",
      "tags": [
        "",
        "ransomware",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "zlepos384",
        "id": "103244",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 8010,
        "FileHash-SHA1": 7922,
        "FileHash-SHA256": 8893,
        "URL": 57004,
        "domain": 36018,
        "hostname": 96473
      },
      "indicator_count": 214320,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 44,
      "modified_text": "127 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "691a02d238fcc3cdca917f79",
      "name": "Top 10 Malware Q3 2025",
      "description": "In the third quarter of 2025, the frequency of malware notifications rose by 38%, indicating an escalating cyber threat landscape. Notably, SocGholish remained the most prevalent malware, accounting for 26% of detections. It functions as a downloader, primarily written in JavaScript, and is disseminated through malicious websites that impersonate legitimate browser updates. Infections from SocGholish can result in further exploitation, including the deployment of remote access tools (RATs) like NetSupport and AsyncRAT. The Multi-State Information Sharing and Analysis Center (MS-ISAC) identifies three primary initial infection vectors for the top malware: Dropped, Malspam, and Malvertisement, with some malware exhibiting multiple infection methods depending on their context.",
      "modified": "2025-11-16T16:58:58.497000",
      "created": "2025-11-16T16:58:58.497000",
      "tags": [
        "lumma stealer",
        "sha256 hashes",
        "malware",
        "jinupd",
        "coinminer",
        "agent tesla",
        "cis cti",
        "msisac",
        "javascript",
        "netsupport",
        "gh0st",
        "telegrab",
        "venomrat",
        "asyncrat",
        "malspam",
        "nanocore",
        "cobalt strike",
        "telegram",
        "service",
        "jackpos",
        "leverage",
        "local",
        "zphp",
        "socgholish",
        "lumma"
      ],
      "references": [
        "https://www.cisecurity.org/insights/blog/top-10-malware-q3-2025"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Jinupd",
          "display_name": "Jinupd",
          "target": null
        },
        {
          "id": "Malspam",
          "display_name": "Malspam",
          "target": null
        },
        {
          "id": "VenomRat",
          "display_name": "VenomRat",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "ZPHP",
          "display_name": "ZPHP",
          "target": null
        },
        {
          "id": "SocGholish",
          "display_name": "SocGholish",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 33,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 49,
        "domain": 17,
        "hostname": 12
      },
      "indicator_count": 144,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "195 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6564dbf69e671f17f456ebe7",
      "name": "officeaddons.com",
      "description": "",
      "modified": "2025-06-04T17:22:01.994000",
      "created": "2023-11-27T18:12:05.989000",
      "tags": [
        "DPRK"
      ],
      "references": [
        "https://www.virustotal.com/graph/g86e7fd92613f491a8809ed2c0d5a4c0f19da965b3fde4d82ada88a957b138b68"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 27,
        "FileHash-SHA1": 27,
        "FileHash-SHA256": 165,
        "domain": 181,
        "hostname": 10
      },
      "indicator_count": 410,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "360 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67617edafa11fa408b73322c",
      "name": "ACTIVIDAD MALICIOSA | Relacionada con Lumma Stealer 17-12-2024",
      "description": "Lumma Stealer es un tipo de software malicioso dise\u00f1ado para robar informaci\u00f3n confidencial de los dispositivos infectados. Este malware se infiltra en los sistemas y extrae datos personales, como nombres de usuario, contrase\u00f1as, informaci\u00f3n bancaria y detalles de tarjetas de cr\u00e9dito. LummaStealer puede afectar varias cuentas, incluidas redes sociales, correos electr\u00f3nicos y monederos de criptomonedas. Los delincuentes pueden usar la informaci\u00f3n robada para chantaje, suplantaci\u00f3n de identidad, y realizar transacciones fraudulentas, lo que puede causar serios problemas de privacidad y p\u00e9rdidas econ\u00f3micas significativas para las v\u00edctimas.",
      "modified": "2025-01-16T13:03:38.406000",
      "created": "2024-12-17T13:38:34.760000",
      "tags": [
        "access",
        "discovery",
        "ta0001 initial",
        "t1003 data",
        "local system",
        "t1033 system",
        "t1057 process",
        "t1082 system",
        "t1087 account"
      ],
      "references": [
        "https://darfe.es/ciberwiki/index.php?title=Lumma",
        "https://www.virustotal.com/graph/embed/gec57b97e0f194fd38738be6392abba6f180fe9d93be24891af76fb2c7bec3638?theme=dark",
        "https://www.virustotal.com/gui/collection/bf70caf191025dfa3e68e8bc63882880ae2ca60f72ece512aaee246b487c5ad6"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "esoporteingenieria2020",
        "id": "121604",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 26,
        "FileHash-SHA1": 25,
        "FileHash-SHA256": 27,
        "URL": 301,
        "domain": 665,
        "hostname": 8
      },
      "indicator_count": 1052,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 267,
      "modified_text": "499 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "674c9f48cd2a512e28ef6523",
      "name": "ACTIVIDAD MALICIOSA | Relacionada con LummaStealer 01-12-2024",
      "description": "Lumma Stealer es un tipo de software malicioso dise\u00f1ado para robar informaci\u00f3n confidencial de los dispositivos infectados. Este malware se infiltra en los sistemas y extrae datos personales, como nombres de usuario, contrase\u00f1as, informaci\u00f3n bancaria y detalles de tarjetas de cr\u00e9dito. LummaStealer puede afectar varias cuentas, incluidas redes sociales, correos electr\u00f3nicos y monederos de criptomonedas. Los delincuentes pueden usar la informaci\u00f3n robada para chantaje, suplantaci\u00f3n de identidad, y realizar transacciones fraudulentas, lo que puede causar serios problemas de privacidad y p\u00e9rdidas econ\u00f3micas significativas para las v\u00edctimas.",
      "modified": "2024-12-31T17:05:00.863000",
      "created": "2024-12-01T17:39:20.573000",
      "tags": [
        "http",
        "access",
        "discovery",
        "uexfvbqog9i67m",
        "mmirygls1g",
        "vt51x7b9cwn7e4x",
        "v2fnqdfylkobc",
        "tcticas",
        "ta0001 initial",
        "t1003 data"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g31920c46027f42a085f0a4040c4609fcccba0ba580b3451893964f393d84ac65?theme=dark",
        "https://www.virustotal.com/gui/collection/9419ada66b99877877ab2cbbe22a5e2de65cd18153db39736cb4fe1d06cc1129",
        "https://darfe.es/ciberwiki/index.php?title=Lumma"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "esoporteingenieria2020",
        "id": "121604",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1161,
        "FileHash-SHA1": 1159,
        "FileHash-SHA256": 1167,
        "URL": 255,
        "domain": 665,
        "hostname": 8
      },
      "indicator_count": 4415,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 266,
      "modified_text": "515 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "656da1f1f7134027660ccba0",
      "name": "Summary of the activities of the group UAC-0006 as of 01.12.2023",
      "description": "The full text of the full report on the events of 7 July 2017:..-. and the details will appear on BBC Radio 5 live on Monday, 7 September. (19:00 BST).",
      "modified": "2024-01-03T09:00:33.796000",
      "created": "2023-12-04T09:54:57.524000",
      "tags": [],
      "references": [
        "https://cert.gov.ua/article/6276584"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunter_NL",
        "id": "171283",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 93,
        "FileHash-SHA1": 14,
        "FileHash-SHA256": 93,
        "domain": 25,
        "URL": 30,
        "hostname": 1
      },
      "indicator_count": 256,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 862,
      "modified_text": "878 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657fba950960704911232093",
      "name": "\u8fd1\u671fUTG-Q-003 \u7ec4\u7ec7\u653b\u51fb\u4e8b\u4ef6",
      "description": "\u8fd1\u671f\uff0c\u5a01\u80c1\u7814\u7a76\u4eba\u5458\u8ffd\u8e2a\u5230 UTG-Q-003 \u7ec4\u7ec7\u653b\u51fb\u4e8b\u4ef6",
      "modified": "2023-12-18T03:21:49.323000",
      "created": "2023-12-18T03:20:53.524000",
      "tags": [
        "HotSpot"
      ],
      "references": [
        ""
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "leiwen15",
        "id": "157128",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 20,
        "hostname": 16
      },
      "indicator_count": 36,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 42,
      "modified_text": "895 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "plengreg.fun",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "plengreg.fun",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780203659.3323495
}