{
  "type": "Domain",
  "indicator": "studyrf.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/studyrf.com",
    "alexa": "http://www.alexa.com/siteinfo/studyrf.com",
    "indicator": "studyrf.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3641610847,
      "indicator": "studyrf.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6654198962e43dc463f692c2",
          "name": "DOH IP & URL IOC",
          "description": "The following is the full text of the report on the findings of this year's World Cup in Brazil, which was held at the same time as the 2016 Olympics in Rio de Janeiro, Brazil.",
          "modified": "2024-09-25T04:01:33.267000",
          "created": "2024-05-27T05:26:33.698000",
          "tags": [
            "iocs https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 59,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "fueledbycoffeeDXB",
            "id": "272228",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 270,
            "CIDR": 1,
            "domain": 116,
            "hostname": 33,
            "FileHash-MD5": 1
          },
          "indicator_count": 421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 31,
          "modified_text": "615 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6513eca597c209f832387d68",
          "name": "\u4eca\u5e74\u5e74\u521d\uff0cEmotet\u94f6\u884c\u6728\u9a6c\u518d\u6b21\u51fa\u73b0",
          "description": "Emotet\uff08\u4e5f\u88ab\u79f0\u4e3aGeodo\u548cHeodo\uff09\u4e0d\u4ec5\u662f\u4e00\u79cd\u8457\u540d\u7684\u94f6\u884c\u6728\u9a6c\uff0c\u540c\u65f6\u4e5f\u53ef\u4ee5\u4f5c\u4e3a\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u7684downloader\u6216dropper\u3002\u81ea2014\u5e74\u9996\u6b21\u51fa\u73b0\u4ee5\u6765\uff0c\u4e00\u76f4\u662f\u4e00\u79cd\u5177\u6709\u5371\u9669\u6027\u548c\u6301\u4e45\u6027\u7684\u6076\u610f\u8f6f\u4ef6\u3002\u5c3d\u7ba1\u57282021\u5e74\u521d\u6267\u6cd5\u673a\u6784\u8bd5\u56fe\u5c06\u5176\u5173\u95ed\uff0c\u4f46Emotet\u8868\u73b0\u51fa\u6781\u5f3a\u7684\u751f\u5b58\u529b\uff0c\u751a\u81f3\u5728\u6b27\u6d32\u5211\u8b66\u7ec4\u7ec7\u8fdb\u884c\u4e86\u91cd\u5927\u6253\u51fb\u884c\u52a8\u540e\u4ecd\u7136\u5b58\u6d3b\u3002\u4eca\u5e74\uff0c\u5b83\u4ee5epoch4\u548cepoch5\u7248\u672c\u56de\u5f52\uff0c\u5e76\u5229\u7528Microsoft Word\u548cMicrosoft OneNote\u4e2d\u7684\u5b8f\u548c\u5d4c\u5165\u5f0f\u811a\u672c\u8fdb\u884c\u611f\u67d3\u548c\u4f20\u64ad\u3002",
          "modified": "2023-10-27T08:05:43.362000",
          "created": "2023-09-27T08:49:41.129000",
          "tags": [
            "Emotet",
            "downloader",
            "HotSpot"
          ],
          "references": [
            "https://www.trellix.com/en-us/about/newsroom/stories/research/icymi-emotet-reappeared-early-this-year-unfortunately.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "jintianxingqiji",
            "id": "243725",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243725/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 95,
            "domain": 38,
            "hostname": 9
          },
          "indicator_count": 142,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 29,
          "modified_text": "949 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64186efb728d1ea3633c3dc6",
          "name": "Emotet Sending Malicious Emails After Three-Month Hiatus",
          "description": "New Emotet malicious email activity suggest the Emotet Group has restarted activities after taking a few months long hiatus. The detected email activity shows it inserting itself into existing email chains with a malicious unprotected zip attachment, with a financial invoice theme to lure victims. Inside the zip file, there is an Office Word document with macros. Office requests the user to enable content, to which, if accepted, macros run in the background to download and execute the Emotet DLL. It is not known how long this round of email activity will take but from previous rounds, it can be expected to last a few weeks and then disappear for months. Trellix ENS detection: W97M/Downloader.dwu trojan For the current Emotet campaign, Trellix has added a policy rule for the zip attachments that can be enabled on the Email appliances.",
          "modified": "2023-04-19T14:04:39.791000",
          "created": "2023-03-20T14:34:35.037000",
          "tags": [
            "https",
            "http",
            "javascript",
            "help center",
            "please",
            "service privacy",
            "policy cookie",
            "policy imprint",
            "ads info",
            "twitter",
            "emotet",
            "figure",
            "tuesday",
            "march",
            "office",
            "emotet botnet",
            "emotet email",
            "office document",
            "enable content",
            "november"
          ],
          "references": [
            "https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/",
            "https://twitter.com/Cryptolaemus1/status/1633099154623803394?s=20"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "display_name": "T1193 - Spearphishing Attachment"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1059.003",
              "name": "Windows Command Shell",
              "display_name": "T1059.003 - Windows Command Shell"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1009",
              "name": "Binary Padding",
              "display_name": "T1009 - Binary Padding"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.005",
              "name": "Match Legitimate Name or Location",
              "display_name": "T1036.005 - Match Legitimate Name or Location"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1117",
              "name": "Regsvr32",
              "display_name": "T1117 - Regsvr32"
            },
            {
              "id": "T1070.006",
              "name": "Timestomp",
              "display_name": "T1070.006 - Timestomp"
            },
            {
              "id": "T1503",
              "name": "Credentials from Web Browsers",
              "display_name": "T1503 - Credentials from Web Browsers"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "BITSecurity",
            "id": "103352",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_103352/resized/80/avatar_1540652530.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 40,
            "URL": 108,
            "hostname": 10,
            "FileHash-MD5": 325,
            "FileHash-SHA1": 277,
            "FileHash-SHA256": 279
          },
          "indicator_count": 1039,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 242,
          "modified_text": "1140 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "640ee316c2bada8ce092da7e",
          "name": "Threat Intel Report - W11-2023",
          "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.",
          "modified": "2023-04-12T08:01:25.791000",
          "created": "2023-03-13T08:47:18.159000",
          "tags": [],
          "references": [
            "https://www.spamcop.net/",
            "https://www.cvedetails.com/vulnerability-list/year-2019/vulnerabilities.html",
            "https://www.silobreaker.com/category/threat-reports/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "aa00643640@techmahindra.com",
            "id": "156540",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 62,
            "FileHash-MD5": 15,
            "FileHash-SHA1": 13,
            "FileHash-SHA256": 65,
            "CVE": 5,
            "URL": 142,
            "domain": 124
          },
          "indicator_count": 426,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 107,
          "modified_text": "1147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "640bcd190eefa1035e8ba17f",
          "name": "InQuest - 10-03-2023",
          "description": "",
          "modified": "2023-04-10T00:04:51.028000",
          "created": "2023-03-11T00:36:41.123000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 181,
            "domain": 904,
            "URL": 1409,
            "hostname": 244,
            "FileHash-SHA1": 14,
            "FileHash-MD5": 41
          },
          "indicator_count": 2793,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "1149 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "640a773e2ec4f56370397ea3",
          "name": "URLHaus data - 09-03-2023",
          "description": "",
          "modified": "2023-04-09T00:03:14.392000",
          "created": "2023-03-10T00:18:06.563000",
          "tags": [
            "32-bit",
            "elf",
            "mips",
            "Mozi",
            "mirai",
            "arm",
            "hajime",
            "32",
            "intel",
            "sparc",
            "PowerPC",
            "renesas",
            "motorola",
            "BB18",
            "dll",
            "geofenced",
            "Qakbot",
            "qbot",
            "Quakbot",
            "ua-ps",
            "USA",
            "dropped-by-PrivateLoader",
            "zip",
            "encrypted",
            "RedLine",
            "gafgyt",
            "250255",
            "5050",
            "Gozi",
            "ISFB",
            "ITA",
            "ursnif",
            "dropped-by-amadey",
            "LaplasClipper",
            "exe",
            "ascii",
            "powershell",
            "ps",
            "7712",
            "redir-302",
            "emotet",
            "epoch4",
            "heodo",
            "batloader",
            "msi",
            "Pinesville Ltd",
            "RecordBreaker",
            "RedLineStealer",
            "Amadey",
            "Vidar",
            "AgentTesla",
            "SnakeKeylogger",
            "2022",
            "Password-protected",
            "rar",
            "1234",
            "2023",
            "agenziaentrate",
            "MEF",
            "MISE",
            "QuasarRAT",
            "rat",
            "hta",
            "Formbook",
            "opendir",
            "Loki",
            "Stealc",
            "Encoded",
            "GuLoader",
            "shellscript",
            "Rhadamanthys",
            "CoinMiner",
            "njRAT",
            "SocGholish"
          ],
          "references": [
            "https://urlhaus.abuse.ch/browse/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1000,
            "domain": 39,
            "hostname": 14
          },
          "indicator_count": 1053,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "1150 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "640a7749915cf578a0f31000",
          "name": "InQuest - 09-03-2023",
          "description": "",
          "modified": "2023-04-09T00:03:14.392000",
          "created": "2023-03-10T00:18:17.075000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 8,
            "domain": 1360,
            "URL": 1668,
            "hostname": 167,
            "FileHash-MD5": 31,
            "FileHash-SHA256": 102
          },
          "indicator_count": 3336,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "1150 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://twitter.com/Cryptolaemus1/status/1633099154623803394?s=20",
        "https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/",
        "https://www.cvedetails.com/vulnerability-list/year-2019/vulnerabilities.html",
        "https://www.silobreaker.com/category/threat-reports/",
        "https://www.spamcop.net/",
        "https://www.trellix.com/en-us/about/newsroom/stories/research/icymi-emotet-reappeared-early-this-year-unfortunately.html",
        "https://urlhaus.abuse.ch/browse/",
        "https://labs.inquest.net/iocdb"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Emotet"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6654198962e43dc463f692c2",
      "name": "DOH IP & URL IOC",
      "description": "The following is the full text of the report on the findings of this year's World Cup in Brazil, which was held at the same time as the 2016 Olympics in Rio de Janeiro, Brazil.",
      "modified": "2024-09-25T04:01:33.267000",
      "created": "2024-05-27T05:26:33.698000",
      "tags": [
        "iocs https"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 59,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "fueledbycoffeeDXB",
        "id": "272228",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 270,
        "CIDR": 1,
        "domain": 116,
        "hostname": 33,
        "FileHash-MD5": 1
      },
      "indicator_count": 421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 31,
      "modified_text": "615 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6513eca597c209f832387d68",
      "name": "\u4eca\u5e74\u5e74\u521d\uff0cEmotet\u94f6\u884c\u6728\u9a6c\u518d\u6b21\u51fa\u73b0",
      "description": "Emotet\uff08\u4e5f\u88ab\u79f0\u4e3aGeodo\u548cHeodo\uff09\u4e0d\u4ec5\u662f\u4e00\u79cd\u8457\u540d\u7684\u94f6\u884c\u6728\u9a6c\uff0c\u540c\u65f6\u4e5f\u53ef\u4ee5\u4f5c\u4e3a\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u7684downloader\u6216dropper\u3002\u81ea2014\u5e74\u9996\u6b21\u51fa\u73b0\u4ee5\u6765\uff0c\u4e00\u76f4\u662f\u4e00\u79cd\u5177\u6709\u5371\u9669\u6027\u548c\u6301\u4e45\u6027\u7684\u6076\u610f\u8f6f\u4ef6\u3002\u5c3d\u7ba1\u57282021\u5e74\u521d\u6267\u6cd5\u673a\u6784\u8bd5\u56fe\u5c06\u5176\u5173\u95ed\uff0c\u4f46Emotet\u8868\u73b0\u51fa\u6781\u5f3a\u7684\u751f\u5b58\u529b\uff0c\u751a\u81f3\u5728\u6b27\u6d32\u5211\u8b66\u7ec4\u7ec7\u8fdb\u884c\u4e86\u91cd\u5927\u6253\u51fb\u884c\u52a8\u540e\u4ecd\u7136\u5b58\u6d3b\u3002\u4eca\u5e74\uff0c\u5b83\u4ee5epoch4\u548cepoch5\u7248\u672c\u56de\u5f52\uff0c\u5e76\u5229\u7528Microsoft Word\u548cMicrosoft OneNote\u4e2d\u7684\u5b8f\u548c\u5d4c\u5165\u5f0f\u811a\u672c\u8fdb\u884c\u611f\u67d3\u548c\u4f20\u64ad\u3002",
      "modified": "2023-10-27T08:05:43.362000",
      "created": "2023-09-27T08:49:41.129000",
      "tags": [
        "Emotet",
        "downloader",
        "HotSpot"
      ],
      "references": [
        "https://www.trellix.com/en-us/about/newsroom/stories/research/icymi-emotet-reappeared-early-this-year-unfortunately.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "jintianxingqiji",
        "id": "243725",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243725/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 95,
        "domain": 38,
        "hostname": 9
      },
      "indicator_count": 142,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 29,
      "modified_text": "949 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64186efb728d1ea3633c3dc6",
      "name": "Emotet Sending Malicious Emails After Three-Month Hiatus",
      "description": "New Emotet malicious email activity suggest the Emotet Group has restarted activities after taking a few months long hiatus. The detected email activity shows it inserting itself into existing email chains with a malicious unprotected zip attachment, with a financial invoice theme to lure victims. Inside the zip file, there is an Office Word document with macros. Office requests the user to enable content, to which, if accepted, macros run in the background to download and execute the Emotet DLL. It is not known how long this round of email activity will take but from previous rounds, it can be expected to last a few weeks and then disappear for months. Trellix ENS detection: W97M/Downloader.dwu trojan For the current Emotet campaign, Trellix has added a policy rule for the zip attachments that can be enabled on the Email appliances.",
      "modified": "2023-04-19T14:04:39.791000",
      "created": "2023-03-20T14:34:35.037000",
      "tags": [
        "https",
        "http",
        "javascript",
        "help center",
        "please",
        "service privacy",
        "policy cookie",
        "policy imprint",
        "ads info",
        "twitter",
        "emotet",
        "figure",
        "tuesday",
        "march",
        "office",
        "emotet botnet",
        "emotet email",
        "office document",
        "enable content",
        "november"
      ],
      "references": [
        "https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/",
        "https://twitter.com/Cryptolaemus1/status/1633099154623803394?s=20"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "display_name": "T1193 - Spearphishing Attachment"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1059.003",
          "name": "Windows Command Shell",
          "display_name": "T1059.003 - Windows Command Shell"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1009",
          "name": "Binary Padding",
          "display_name": "T1009 - Binary Padding"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.005",
          "name": "Match Legitimate Name or Location",
          "display_name": "T1036.005 - Match Legitimate Name or Location"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1117",
          "name": "Regsvr32",
          "display_name": "T1117 - Regsvr32"
        },
        {
          "id": "T1070.006",
          "name": "Timestomp",
          "display_name": "T1070.006 - Timestomp"
        },
        {
          "id": "T1503",
          "name": "Credentials from Web Browsers",
          "display_name": "T1503 - Credentials from Web Browsers"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "BITSecurity",
        "id": "103352",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_103352/resized/80/avatar_1540652530.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 40,
        "URL": 108,
        "hostname": 10,
        "FileHash-MD5": 325,
        "FileHash-SHA1": 277,
        "FileHash-SHA256": 279
      },
      "indicator_count": 1039,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 242,
      "modified_text": "1140 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "640ee316c2bada8ce092da7e",
      "name": "Threat Intel Report - W11-2023",
      "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.",
      "modified": "2023-04-12T08:01:25.791000",
      "created": "2023-03-13T08:47:18.159000",
      "tags": [],
      "references": [
        "https://www.spamcop.net/",
        "https://www.cvedetails.com/vulnerability-list/year-2019/vulnerabilities.html",
        "https://www.silobreaker.com/category/threat-reports/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "aa00643640@techmahindra.com",
        "id": "156540",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 62,
        "FileHash-MD5": 15,
        "FileHash-SHA1": 13,
        "FileHash-SHA256": 65,
        "CVE": 5,
        "URL": 142,
        "domain": 124
      },
      "indicator_count": 426,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 107,
      "modified_text": "1147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "640bcd190eefa1035e8ba17f",
      "name": "InQuest - 10-03-2023",
      "description": "",
      "modified": "2023-04-10T00:04:51.028000",
      "created": "2023-03-11T00:36:41.123000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 181,
        "domain": 904,
        "URL": 1409,
        "hostname": 244,
        "FileHash-SHA1": 14,
        "FileHash-MD5": 41
      },
      "indicator_count": 2793,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "1149 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "640a773e2ec4f56370397ea3",
      "name": "URLHaus data - 09-03-2023",
      "description": "",
      "modified": "2023-04-09T00:03:14.392000",
      "created": "2023-03-10T00:18:06.563000",
      "tags": [
        "32-bit",
        "elf",
        "mips",
        "Mozi",
        "mirai",
        "arm",
        "hajime",
        "32",
        "intel",
        "sparc",
        "PowerPC",
        "renesas",
        "motorola",
        "BB18",
        "dll",
        "geofenced",
        "Qakbot",
        "qbot",
        "Quakbot",
        "ua-ps",
        "USA",
        "dropped-by-PrivateLoader",
        "zip",
        "encrypted",
        "RedLine",
        "gafgyt",
        "250255",
        "5050",
        "Gozi",
        "ISFB",
        "ITA",
        "ursnif",
        "dropped-by-amadey",
        "LaplasClipper",
        "exe",
        "ascii",
        "powershell",
        "ps",
        "7712",
        "redir-302",
        "emotet",
        "epoch4",
        "heodo",
        "batloader",
        "msi",
        "Pinesville Ltd",
        "RecordBreaker",
        "RedLineStealer",
        "Amadey",
        "Vidar",
        "AgentTesla",
        "SnakeKeylogger",
        "2022",
        "Password-protected",
        "rar",
        "1234",
        "2023",
        "agenziaentrate",
        "MEF",
        "MISE",
        "QuasarRAT",
        "rat",
        "hta",
        "Formbook",
        "opendir",
        "Loki",
        "Stealc",
        "Encoded",
        "GuLoader",
        "shellscript",
        "Rhadamanthys",
        "CoinMiner",
        "njRAT",
        "SocGholish"
      ],
      "references": [
        "https://urlhaus.abuse.ch/browse/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1000,
        "domain": 39,
        "hostname": 14
      },
      "indicator_count": 1053,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "1150 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "640a7749915cf578a0f31000",
      "name": "InQuest - 09-03-2023",
      "description": "",
      "modified": "2023-04-09T00:03:14.392000",
      "created": "2023-03-10T00:18:17.075000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 8,
        "domain": 1360,
        "URL": 1668,
        "hostname": 167,
        "FileHash-MD5": 31,
        "FileHash-SHA256": 102
      },
      "indicator_count": 3336,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "1150 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "studyrf.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "studyrf.com",
    "found": true,
    "verdict": "malicious",
    "url_count": 1,
    "online_count": 0,
    "blacklists": {
      "spamhaus_dbl": "not listed",
      "surbl": "not listed"
    },
    "urls": [
      {
        "url": "https://studyrf.com/information/wrzZ/",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2023-03-09",
        "tags": [
          "dll",
          "emotet",
          "epoch4",
          "heodo",
          "zip"
        ]
      }
    ],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780418904.171165
}