{ "type": "Domain", "indicator": "two-root.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/two-root.com", "alexa": "http://www.alexa.com/siteinfo/two-root.com", "indicator": "two-root.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3965482666, "indicator": "two-root.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "66dec11ad9c488b7b2a839cb", "name": "LummaC2 Malware and Malicious Chrome Extension Delivered", "description": "In August 2024, eSentire's Threat Response Unit observed a sophisticated attack involving LummaC2 stealer malware and a malicious Google Chrome browser extension. The attack leveraged DLL side-loading to execute a loader delivering the malware and a PowerShell script that installed the extension. The extension manipulated browser activities, stole data like credentials and crypto wallets, and enabled remote control of infected systems. The infection chain showcased evasive tactics and the ability to dynamically alter web content, highlighting the importance of robust endpoint security, security awareness training, and secure software configurations.", "modified": "2024-09-09T09:36:53.816000", "created": "2024-09-09T09:34:18.057000", "tags": [ "lummac2", "extension", "stealer", "browser", "control", "malware", "remote", "crypto", "credentials" ], "references": [ "https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extension-delivered-via-dll-side-loading" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LummaC2", "display_name": "LummaC2", "target": null } ], "attack_ids": [ { "id": "T1574.002", "name": "DLL Side-Loading", "display_name": "T1574.002 - DLL Side-Loading" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 87, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "URL": 2, "domain": 5 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 386511, "modified_text": "629 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6793da0446e4545a8001090e", "name": "LummaC2 Indicators of Compromise - 2024", "description": "https://github.com/eSentire/iocs/blob/main/LummaC2/LummaC2%20and%20Malicious%20Chrome%20Extension%20Delivered%20via%20DLL%20Side-Loading.txt", "modified": "2025-01-24T18:20:52.206000", "created": "2025-01-24T18:20:52.206000", "tags": [ "lummaC2" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "lummaC2", "display_name": "lummaC2", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "InformationTechnogyISAC", "id": "141282", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 2, "domain": 7 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "491 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67768389d9fecc480a55978b", "name": "Usage of the LegionLoader malware to Steal Credentials", "description": "LegionLoader malware evolves, posing significant cybersecurity threats.", "modified": "2025-01-02T12:16:09.844000", "created": "2025-01-02T12:16:09.844000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 483, "FileHash-SHA1": 16, "FileHash-SHA256": 16, "URL": 43, "domain": 24 }, "indicator_count": 582, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "513 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f73a3f45fa88890276d", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:23.616000", "created": "2024-11-24T03:37:23.616000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f7224d433f384b935c8", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:22.551000", "created": "2024-11-24T03:37:22.551000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 20, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670f94e03014212e19fa5a77", "name": "Malicious-Dangerous-Domain&URL-New-IOC List", "description": "By Helaly", "modified": "2024-11-15T10:01:11.688000", "created": "2024-10-16T10:26:40.893000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39659, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 80, "modified_text": "562 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66e179d7520251e162f342b6", "name": "eSentire | LummaC2 Malware and Malicious Chrome Extension Delivered\u2026", "description": "SolarWind's Managed Detection and Response (MDR) is designed to protect your business from cyber attacks, cyber-attacks and cyber security threats from all sources. \u00c2\u00a31.5m", "modified": "2024-09-11T11:07:03.620000", "created": "2024-09-11T11:07:03.620000", "tags": [ "threat response", "unit", "c2 server", "figure", "response", "lummac2 stealer", "tru team", "dll sideloading", "urls", "outlook", "hunters", "cyber", "august", "powershell", "facebook", "phishing", "lummac2" ], "references": [ "https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extension-delivered-via-dll-side-loading", "https://raw.githubusercontent.com/esThreatIntelligence/iocs/main/LummaC2/LummaC2%20and%20Malicious%20Chrome%20Extension%20Delivered%20via%20DLL%20Side-Loading.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LummaC2", "display_name": "LummaC2", "target": null } ], "attack_ids": [ { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1199", "name": "Trusted Relationship", "display_name": "T1199 - Trusted Relationship" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [ "Construction", "Finance", "Legal", "Manufacturing", "Healthcare", "Retail", "Food", "Government", "Education", "Automotive" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 22, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 3, "domain": 8 }, "indicator_count": 73, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "627 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66df562bb07869ab54bb5972", "name": "LummaC2 Stealer and Malicious Chrome Extension Spread via Drive-By Downloads", "description": "The full list of people who have signed up to be part of the BBC News Channel has been released.. and it is not possible to do it without the help of BBC Radio 4 or BBC iPlayer.", "modified": "2024-09-09T20:10:38.415000", "created": "2024-09-09T20:10:19.003000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 6, "FileHash-SHA256": 6, "domain": 7 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 501, "modified_text": "628 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extension-delivered-via-dll-side-loading", "https://raw.githubusercontent.com/esThreatIntelligence/iocs/main/LummaC2/LummaC2%20and%20Malicious%20Chrome%20Extension%20Delivered%20via%20DLL%20Side-Loading.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Lummac2" ], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Lummac2" ], "industries": [ "Finance", "Government", "Automotive", "Construction", "Legal", "Manufacturing", "Healthcare", "Food", "Retail", "Education" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "66dec11ad9c488b7b2a839cb", "name": "LummaC2 Malware and Malicious Chrome Extension Delivered", "description": "In August 2024, eSentire's Threat Response Unit observed a sophisticated attack involving LummaC2 stealer malware and a malicious Google Chrome browser extension. The attack leveraged DLL side-loading to execute a loader delivering the malware and a PowerShell script that installed the extension. The extension manipulated browser activities, stole data like credentials and crypto wallets, and enabled remote control of infected systems. The infection chain showcased evasive tactics and the ability to dynamically alter web content, highlighting the importance of robust endpoint security, security awareness training, and secure software configurations.", "modified": "2024-09-09T09:36:53.816000", "created": "2024-09-09T09:34:18.057000", "tags": [ "lummac2", "extension", "stealer", "browser", "control", "malware", "remote", "crypto", "credentials" ], "references": [ "https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extension-delivered-via-dll-side-loading" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LummaC2", "display_name": "LummaC2", "target": null } ], "attack_ids": [ { "id": "T1574.002", "name": "DLL Side-Loading", "display_name": "T1574.002 - DLL Side-Loading" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 87, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "URL": 2, "domain": 5 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 386511, "modified_text": "629 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6793da0446e4545a8001090e", "name": "LummaC2 Indicators of Compromise - 2024", "description": "https://github.com/eSentire/iocs/blob/main/LummaC2/LummaC2%20and%20Malicious%20Chrome%20Extension%20Delivered%20via%20DLL%20Side-Loading.txt", "modified": "2025-01-24T18:20:52.206000", "created": "2025-01-24T18:20:52.206000", "tags": [ "lummaC2" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "lummaC2", "display_name": "lummaC2", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "InformationTechnogyISAC", "id": "141282", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 2, "domain": 7 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "491 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67768389d9fecc480a55978b", "name": "Usage of the LegionLoader malware to Steal Credentials", "description": "LegionLoader malware evolves, posing significant cybersecurity threats.", "modified": "2025-01-02T12:16:09.844000", "created": "2025-01-02T12:16:09.844000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 483, "FileHash-SHA1": 16, "FileHash-SHA256": 16, "URL": 43, "domain": 24 }, "indicator_count": 582, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "513 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f73a3f45fa88890276d", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:23.616000", "created": "2024-11-24T03:37:23.616000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67429f7224d433f384b935c8", "name": "StreamMining", "description": "", "modified": "2024-11-24T03:37:22.551000", "created": "2024-11-24T03:37:22.551000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "670f94e03014212e19fa5a77", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "rivocado", "id": "300960", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 20, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670f94e03014212e19fa5a77", "name": "Malicious-Dangerous-Domain&URL-New-IOC List", "description": "By Helaly", "modified": "2024-11-15T10:01:11.688000", "created": "2024-10-16T10:26:40.893000", "tags": [ "eliminar", "leer ms", "wishlist vista", "poltica", "secadores", "vista", "sala", "vaporal", "utensilios", "belleza equipos", "ciudad" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39659, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Eslam-ElHelaly", "id": "259630", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 6, "URL": 170, "domain": 11158, "hostname": 3549 }, "indicator_count": 14883, "is_author": false, "is_subscribing": null, "subscriber_count": 80, "modified_text": "562 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66e179d7520251e162f342b6", "name": "eSentire | LummaC2 Malware and Malicious Chrome Extension Delivered\u2026", "description": "SolarWind's Managed Detection and Response (MDR) is designed to protect your business from cyber attacks, cyber-attacks and cyber security threats from all sources. \u00c2\u00a31.5m", "modified": "2024-09-11T11:07:03.620000", "created": "2024-09-11T11:07:03.620000", "tags": [ "threat response", "unit", "c2 server", "figure", "response", "lummac2 stealer", "tru team", "dll sideloading", "urls", "outlook", "hunters", "cyber", "august", "powershell", "facebook", "phishing", "lummac2" ], "references": [ "https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extension-delivered-via-dll-side-loading", "https://raw.githubusercontent.com/esThreatIntelligence/iocs/main/LummaC2/LummaC2%20and%20Malicious%20Chrome%20Extension%20Delivered%20via%20DLL%20Side-Loading.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LummaC2", "display_name": "LummaC2", "target": null } ], "attack_ids": [ { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1199", "name": "Trusted Relationship", "display_name": "T1199 - Trusted Relationship" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [ "Construction", "Finance", "Legal", "Manufacturing", "Healthcare", "Retail", "Food", "Government", "Education", "Automotive" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 22, "FileHash-SHA1": 19, "FileHash-SHA256": 19, "URL": 3, "domain": 8 }, "indicator_count": 73, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "627 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66df562bb07869ab54bb5972", "name": "LummaC2 Stealer and Malicious Chrome Extension Spread via Drive-By Downloads", "description": "The full list of people who have signed up to be part of the BBC News Channel has been released.. and it is not possible to do it without the help of BBC Radio 4 or BBC iPlayer.", "modified": "2024-09-09T20:10:38.415000", "created": "2024-09-09T20:10:19.003000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 6, "FileHash-SHA256": 6, "domain": 7 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 501, "modified_text": "628 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "two-root.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "two-root.com", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://two-root.com/2407.bs64", "status": "offline", "threat": "malware_download", "date_added": "2024-07-29", "tags": [ "ascii", "Encoded", "LegionLoader", "obfuscated", "xored" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780225641.0176177 }