{ "type": "Domain", "indicator": "slimpackage.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/slimpackage.com", "alexa": "http://www.alexa.com/siteinfo/slimpackage.com", "indicator": "slimpackage.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3354270501, "indicator": "slimpackage.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "65707ee38c2c82ccca038ab3", "name": "C2 Servers & Virus Providers & Malware Hashes", "description": "", "modified": "2023-12-06T14:02:11.248000", "created": "2023-12-06T14:02:11.248000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3678, "FileHash-SHA256": 4085, "FileHash-SHA1": 745, "FileHash-MD5": 789, "domain": 400, "hostname": 181 }, "indicator_count": 9878, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707cad2da86a95032f640e", "name": "ThreatFox IOC Database", "description": "", "modified": "2023-12-06T13:52:45.664000", "created": "2023-12-06T13:52:45.664000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707cab36254ea6a3446f79", "name": "ThreatFox IOC Database", "description": "", "modified": "2023-12-06T13:52:43.341000", "created": "2023-12-06T13:52:43.341000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652b1d2b113b44d8a0745592", "name": "LokiBot (LokiPWS) IoC between 2020 and 2023 - Collection made from public sources", "description": "These IoC are a collection of LokiBot C2 Data collected from public sources and automatically enriched by OTX. \nIf you find any true false positives, please contact me via my socials: https://linktr.ee/gi7w0rm", "modified": "2023-11-13T22:04:06.580000", "created": "2023-10-14T22:58:51.814000", "tags": [ "LokiBot", "LokiPWS", "stealer" ], "references": [ "https://raw.githubusercontent.com/Gi7w0rm/MalwareConfigLists/main/LokiBot/lokibot_2020_to_2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "win.lokipws", "display_name": "win.lokipws", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/Lokibot", "display_name": "ALF:HeraklezEval:Trojan:Win32/Lokibot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "@Gi7w0rm", "id": "165134", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 31, "FileHash-SHA1": 2, "URL": 6013, "domain": 2170, "hostname": 328 }, "indicator_count": 8544, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "932 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6214c4c07ad648745afd57ba", "name": "C2 Servers & Virus Providers & Malware Hashes", "description": "Cobalt Strike, njRAT, Wjw0rm, Loki, AsyncRAT, Vidar, Mirai, Emotet", "modified": "2022-03-24T00:00:00.271000", "created": "2022-02-22T11:10:56.319000", "tags": [ "valhalla", "kill4rnix", "rspich", "lilocc", "mniami", "kirpich", "qmashton", "k1llerni2x", "anapa", "prophef6" ], "references": [ "https://bazaar.abuse.ch/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "bluewatcher", "id": "174522", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 789, "FileHash-SHA1": 745, "FileHash-SHA256": 4085, "URL": 3678, "domain": 400, "hostname": 181 }, "indicator_count": 9878, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "1531 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62035cb62c4236e4db543b38", "name": "TM Feed 17012022", "description": "TM Feed 17012022", "modified": "2022-03-11T00:02:25.171000", "created": "2022-02-09T06:18:30.377000", "tags": [], "references": [ "TM Feed 17012022" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27, "URL": 67, "hostname": 12, "CVE": 3, "FileHash-MD5": 7 }, "indicator_count": 116, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1544 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e1270204520566da40684b", "name": "NewDom-5-20220114", "description": "ICANN-Dom", "modified": "2022-02-28T00:02:07.729000", "created": "2022-01-14T07:32:18.798000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 203, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61e2c1168a875a3afc0b1901", "name": "ThreatFox IOC Database", "description": "Here is a full report on the Cobalt Strike HVC-AS, as well as the RedLine Stealer,RedLineStealer and other cyber-stalkers who targeted victims.", "modified": "2022-02-14T00:00:26.279000", "created": "2022-01-15T12:41:58.293000", "tags": [ "wannacryptor", "mirai mirai", "cobalt strike", "cobaltstrike", "hariomenkel", "virusdeck", "mirai", "lokibot", "redline stealer", "redlinestealer", "nanocore rat", "agent tesla", "formbook", "date", "emotet", "tsunami", "amadey", "astaroth bra", "cryptolaemus1", "raccoon", "stealer", "danabot", "loki", "njrat", "ave maria", "oski stealer", "stop", "dcrat", "nanocore", "hydra", "netwire rc" ], "references": [ "https://threatfox.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e2c11922732d1d2b1dfcd6", "name": "ThreatFox IOC Database", "description": "Here is a full report on the Cobalt Strike HVC-AS, as well as the RedLine Stealer,RedLineStealer and other cyber-stalkers who targeted victims.", "modified": "2022-02-14T00:00:26.279000", "created": "2022-01-15T12:42:01.041000", "tags": [ "wannacryptor", "mirai mirai", "cobalt strike", "cobaltstrike", "hariomenkel", "virusdeck", "mirai", "lokibot", "redline stealer", "redlinestealer", "nanocore rat", "agent tesla", "formbook", "date", "emotet", "tsunami", "amadey", "astaroth bra", "cryptolaemus1", "raccoon", "stealer", "danabot", "loki", "njrat", "ave maria", "oski stealer", "stop", "dcrat", "nanocore", "hydra", "netwire rc" ], "references": [ "https://threatfox.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e6125992eed4fb873d68c8", "name": "Malware dataset 20220117 | Network", "description": "Domain and URL hits observed from a subset of analyzed samples.", "modified": "2022-01-18T01:05:29.824000", "created": "2022-01-18T01:05:29.824000", "tags": [], "references": [ "https://maldatabase.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "maldatabase", "id": "71669", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_71669/resized/80/avatar_d15b868454.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 13 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 1115, "modified_text": "1596 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61def36fbbf4bd2b73890631", "name": "LOKIBOT | |NUEVOS INDICADORES EN ENERO 2022", "description": "LokiBot tambi\u00e9n conocido como Loki PWS, fue detectado por primera vez en el a\u00f1o 2015 y es utilizado por diferentes grupos criminales que modifican la herramienta para desarrollar sus propias versiones.", "modified": "2022-01-12T15:27:43.486000", "created": "2022-01-12T15:27:43.486000", "tags": [ "windows", "busque", "linux", "lokibot", "utilice", "supervise", "monitorear", "windows que", "til para", "windows como", "alerta", "winscp", "capture" ], "references": [ "https://otx.alienvault.com/pulse/61dc20f9debab2817eb12c2d", "https://otx.alienvault.com/pulse/61dec3fbc0324eb1310c867e", "https://alertas-y-seguridad.jimdosite.com/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "esoporteingenieria2020", "id": "121604", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2, "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 1 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 267, "modified_text": "1602 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61dec3fbc0324eb1310c867e", "name": "LokiBot malware indicators | 20220111", "description": "Indicators of compromise extracted from analyzed samples of LokiBot malware family. This report only includes a subset of the samples analyzed on 20220111.", "modified": "2022-01-12T12:05:15.012000", "created": "2022-01-12T12:05:15.012000", "tags": [ "LokiBot" ], "references": [ "https://maldatabase.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "maldatabase", "id": "71669", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_71669/resized/80/avatar_d15b868454.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 5 }, "indicator_count": 16, "is_author": false, "is_subscribing": null, "subscriber_count": 1117, "modified_text": "1602 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61de2959f741d4874e30c1b2", "name": "Malware dataset 20220111 | Network", "description": "Domain and URL hits observed from a subset of analyzed samples.", "modified": "2022-01-12T01:05:29.495000", "created": "2022-01-12T01:05:29.495000", "tags": [], "references": [ "https://maldatabase.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "maldatabase", "id": "71669", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_71669/resized/80/avatar_d15b868454.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7, "hostname": 4 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 1115, "modified_text": "1602 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://bazaar.abuse.ch/", "TM Feed 17012022", "https://raw.githubusercontent.com/Gi7w0rm/MalwareConfigLists/main/LokiBot/lokibot_2020_to_2023.txt", "https://otx.alienvault.com/pulse/61dec3fbc0324eb1310c867e", "https://otx.alienvault.com/pulse/61dc20f9debab2817eb12c2d", "https://alertas-y-seguridad.jimdosite.com/", "https://maldatabase.com", "https://threatfox.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Alf:heraklezeval:trojan:win32/lokibot", "Win.lokipws" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "65707ee38c2c82ccca038ab3", "name": "C2 Servers & Virus Providers & Malware Hashes", "description": "", "modified": "2023-12-06T14:02:11.248000", "created": "2023-12-06T14:02:11.248000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3678, "FileHash-SHA256": 4085, "FileHash-SHA1": 745, "FileHash-MD5": 789, "domain": 400, "hostname": 181 }, "indicator_count": 9878, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707cad2da86a95032f640e", "name": "ThreatFox IOC Database", "description": "", "modified": "2023-12-06T13:52:45.664000", "created": "2023-12-06T13:52:45.664000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707cab36254ea6a3446f79", "name": "ThreatFox IOC Database", "description": "", "modified": "2023-12-06T13:52:43.341000", "created": "2023-12-06T13:52:43.341000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652b1d2b113b44d8a0745592", "name": "LokiBot (LokiPWS) IoC between 2020 and 2023 - Collection made from public sources", "description": "These IoC are a collection of LokiBot C2 Data collected from public sources and automatically enriched by OTX. \nIf you find any true false positives, please contact me via my socials: https://linktr.ee/gi7w0rm", "modified": "2023-11-13T22:04:06.580000", "created": "2023-10-14T22:58:51.814000", "tags": [ "LokiBot", "LokiPWS", "stealer" ], "references": [ "https://raw.githubusercontent.com/Gi7w0rm/MalwareConfigLists/main/LokiBot/lokibot_2020_to_2023.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "win.lokipws", "display_name": "win.lokipws", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/Lokibot", "display_name": "ALF:HeraklezEval:Trojan:Win32/Lokibot", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "@Gi7w0rm", "id": "165134", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 31, "FileHash-SHA1": 2, "URL": 6013, "domain": 2170, "hostname": 328 }, "indicator_count": 8544, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "932 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6214c4c07ad648745afd57ba", "name": "C2 Servers & Virus Providers & Malware Hashes", "description": "Cobalt Strike, njRAT, Wjw0rm, Loki, AsyncRAT, Vidar, Mirai, Emotet", "modified": "2022-03-24T00:00:00.271000", "created": "2022-02-22T11:10:56.319000", "tags": [ "valhalla", "kill4rnix", "rspich", "lilocc", "mniami", "kirpich", "qmashton", "k1llerni2x", "anapa", "prophef6" ], "references": [ "https://bazaar.abuse.ch/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "bluewatcher", "id": "174522", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 789, "FileHash-SHA1": 745, "FileHash-SHA256": 4085, "URL": 3678, "domain": 400, "hostname": 181 }, "indicator_count": 9878, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "1531 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62035cb62c4236e4db543b38", "name": "TM Feed 17012022", "description": "TM Feed 17012022", "modified": "2022-03-11T00:02:25.171000", "created": "2022-02-09T06:18:30.377000", "tags": [], "references": [ "TM Feed 17012022" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27, "URL": 67, "hostname": 12, "CVE": 3, "FileHash-MD5": 7 }, "indicator_count": 116, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1544 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e1270204520566da40684b", "name": "NewDom-5-20220114", "description": "ICANN-Dom", "modified": "2022-02-28T00:02:07.729000", "created": "2022-01-14T07:32:18.798000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 203, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61e2c1168a875a3afc0b1901", "name": "ThreatFox IOC Database", "description": "Here is a full report on the Cobalt Strike HVC-AS, as well as the RedLine Stealer,RedLineStealer and other cyber-stalkers who targeted victims.", "modified": "2022-02-14T00:00:26.279000", "created": "2022-01-15T12:41:58.293000", "tags": [ "wannacryptor", "mirai mirai", "cobalt strike", "cobaltstrike", "hariomenkel", "virusdeck", "mirai", "lokibot", "redline stealer", "redlinestealer", "nanocore rat", "agent tesla", "formbook", "date", "emotet", "tsunami", "amadey", "astaroth bra", "cryptolaemus1", "raccoon", "stealer", "danabot", "loki", "njrat", "ave maria", "oski stealer", "stop", "dcrat", "nanocore", "hydra", "netwire rc" ], "references": [ "https://threatfox.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e2c11922732d1d2b1dfcd6", "name": "ThreatFox IOC Database", "description": "Here is a full report on the Cobalt Strike HVC-AS, as well as the RedLine Stealer,RedLineStealer and other cyber-stalkers who targeted victims.", "modified": "2022-02-14T00:00:26.279000", "created": "2022-01-15T12:42:01.041000", "tags": [ "wannacryptor", "mirai mirai", "cobalt strike", "cobaltstrike", "hariomenkel", "virusdeck", "mirai", "lokibot", "redline stealer", "redlinestealer", "nanocore rat", "agent tesla", "formbook", "date", "emotet", "tsunami", "amadey", "astaroth bra", "cryptolaemus1", "raccoon", "stealer", "danabot", "loki", "njrat", "ave maria", "oski stealer", "stop", "dcrat", "nanocore", "hydra", "netwire rc" ], "references": [ "https://threatfox.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46, "hostname": 33, "FileHash-MD5": 123, "FileHash-SHA1": 121, "FileHash-SHA256": 324, "CVE": 1, "URL": 372 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e6125992eed4fb873d68c8", "name": "Malware dataset 20220117 | Network", "description": "Domain and URL hits observed from a subset of analyzed samples.", "modified": "2022-01-18T01:05:29.824000", "created": "2022-01-18T01:05:29.824000", "tags": [], "references": [ "https://maldatabase.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "maldatabase", "id": "71669", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_71669/resized/80/avatar_d15b868454.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 13 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 1115, "modified_text": "1596 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "slimpackage.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "slimpackage.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780440394.4211705 }