{
  "type": "Domain",
  "indicator": "virtualine.org",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/virtualine.org",
    "alexa": "http://www.alexa.com/siteinfo/virtualine.org",
    "indicator": "virtualine.org",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4142055618,
      "indicator": "virtualine.org",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "692a86b454eea18b993a2078",
          "name": "DC RAT Injection | Endgame Systems | Lazarus Group related",
          "description": "Monitoring. MITRE ATT&CK (T1057) Monitored target/s. DNS requests. Property discovery \n\nRelated to Lazarus Groups expansion",
          "modified": "2025-12-29T03:02:56.986000",
          "created": "2025-11-29T05:37:56.021000",
          "tags": [
            "ukraine",
            "win32",
            "dynamicloader",
            "ssl cert",
            "write c",
            "asyncrat",
            "various rat",
            "dcrat",
            "write",
            "guard",
            "malware",
            "all ipv4",
            "ukraine asn",
            "dns resolutions",
            "domains top",
            "level",
            "read c",
            "memcommit",
            "user execution",
            "delete",
            "msie",
            "windows nt",
            "dock",
            "execution",
            "masking",
            "yara rule",
            "high",
            "windows",
            "msvisualcpp60",
            "process",
            "intel",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "flag",
            "ukraine ukraine",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "dynu",
            "mitre att",
            "ck matrix",
            "ascii text",
            "pattern match",
            "network traffic",
            "t1071",
            "t1057",
            "general",
            "local",
            "path",
            "beginstring",
            "segoe ui",
            "null",
            "refresh",
            "body",
            "click",
            "strings",
            "error",
            "tools",
            "title",
            "look",
            "verify",
            "restart"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
            "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
            "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
            "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
              "target": null
            },
            {
              "id": "Win.Trojan.DcRat-10039889-0",
              "display_name": "Win.Trojan.DcRat-10039889-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "TA0039",
              "name": "Remote Service Effects",
              "display_name": "TA0039 - Remote Service Effects"
            },
            {
              "id": "TA0038",
              "name": "Network Effects",
              "display_name": "TA0038 - Network Effects"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 482,
            "URL": 819,
            "FileHash-SHA256": 274,
            "domain": 102,
            "email": 1,
            "FileHash-MD5": 73,
            "FileHash-SHA1": 65,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 1817,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "154 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fa56f45f0516a0b3075e7b",
          "name": "EbeeOct2025 Pt3",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2025-11-22T16:03:43.896000",
          "created": "2025-10-23T16:25:24.750000",
          "tags": [],
          "references": [
            "Oct week.3.pdf"
          ],
          "public": 1,
          "adversary": "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 61,
            "CIDR": 2,
            "CVE": 3,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 135,
            "FileHash-SHA256": 190,
            "URL": 42,
            "email": 8,
            "hostname": 48
          },
          "indicator_count": 664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "191 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9114c86c0defd1b41335e",
          "name": "Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe.",
          "description": "The Caminho Loader, identified by Arctic Wolf, is a sophisticated Brazilian-origin Loader-as-a-Service operation that employs Least Significant Bit (LSB) steganography to conceal malicious .NET payloads within image files hosted on legitimate platforms. Initial infection begins with spear-phishing emails that contain archived JavaScript or VBScript files, often using business-themed social engineering tactics. When executed, these scripts retrieve an obfuscated PowerShell payload that downloads steganographic images from services like archive.org, a digital archive known for its reputation and high availability.",
          "modified": "2025-11-21T17:01:54.389000",
          "created": "2025-10-22T17:15:56.137000",
          "tags": [
            "javascript",
            "caminho loader",
            "remcos rat",
            "powershell",
            "arctic wolf",
            "june",
            "katz stealer",
            "hashes",
            "urls",
            "sha256",
            "august",
            "xworm",
            "wolf",
            "loader",
            "ukraine",
            "phishing",
            "first",
            "remcos",
            "hunt",
            "path",
            "stealer",
            "virustotal",
            "media",
            "click",
            "error",
            "example",
            "date",
            "rats",
            "easy",
            "code",
            "persistence",
            "lost",
            "bmp",
            "hta",
            "caminho",
            "katz"
          ],
          "references": [
            "https://arcticwolf.com/resources/blog/brazilian-caminho-loader-employs-lsb-steganography-to-deliver-multiple-malware-families/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Brazil",
            "South Africa",
            "Ukraine",
            "Poland",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Caminho Loader",
              "display_name": "Caminho Loader",
              "target": null
            },
            {
              "id": "Caminho",
              "display_name": "Caminho",
              "target": null
            },
            {
              "id": "XWorm",
              "display_name": "XWorm",
              "target": null
            },
            {
              "id": "Katz",
              "display_name": "Katz",
              "target": null
            },
            {
              "id": "REMCOS",
              "display_name": "REMCOS",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1559",
              "name": "Inter-Process Communication",
              "display_name": "T1559 - Inter-Process Communication"
            }
          ],
          "industries": [
            "Critical Infrastructure"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-MD5": 18,
            "FileHash-SHA1": 17,
            "FileHash-SHA256": 23,
            "domain": 5
          },
          "indicator_count": 64,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "192 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
        "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
        "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
        "Oct week.3.pdf",
        "https://arcticwolf.com/resources/blog/brazilian-caminho-loader-employs-lsb-steganography-to-deliver-multiple-malware-families/",
        "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor"
          ],
          "malware_families": [
            "Remcos",
            "Caminho loader",
            "Win.trojan.dcrat-10039889-0",
            "Xworm",
            "Caminho",
            "Alf:heraklezeval:trojan:win32/amsitamper.b",
            "Katz"
          ],
          "industries": [
            "Critical infrastructure"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "692a86b454eea18b993a2078",
      "name": "DC RAT Injection | Endgame Systems | Lazarus Group related",
      "description": "Monitoring. MITRE ATT&CK (T1057) Monitored target/s. DNS requests. Property discovery \n\nRelated to Lazarus Groups expansion",
      "modified": "2025-12-29T03:02:56.986000",
      "created": "2025-11-29T05:37:56.021000",
      "tags": [
        "ukraine",
        "win32",
        "dynamicloader",
        "ssl cert",
        "write c",
        "asyncrat",
        "various rat",
        "dcrat",
        "write",
        "guard",
        "malware",
        "all ipv4",
        "ukraine asn",
        "dns resolutions",
        "domains top",
        "level",
        "read c",
        "memcommit",
        "user execution",
        "delete",
        "msie",
        "windows nt",
        "dock",
        "execution",
        "masking",
        "yara rule",
        "high",
        "windows",
        "msvisualcpp60",
        "process",
        "intel",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "flag",
        "ukraine ukraine",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "dynu",
        "mitre att",
        "ck matrix",
        "ascii text",
        "pattern match",
        "network traffic",
        "t1071",
        "t1057",
        "general",
        "local",
        "path",
        "beginstring",
        "segoe ui",
        "null",
        "refresh",
        "body",
        "click",
        "strings",
        "error",
        "tools",
        "title",
        "look",
        "verify",
        "restart"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
        "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
        "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
        "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
          "target": null
        },
        {
          "id": "Win.Trojan.DcRat-10039889-0",
          "display_name": "Win.Trojan.DcRat-10039889-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "TA0039",
          "name": "Remote Service Effects",
          "display_name": "TA0039 - Remote Service Effects"
        },
        {
          "id": "TA0038",
          "name": "Network Effects",
          "display_name": "TA0038 - Network Effects"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 482,
        "URL": 819,
        "FileHash-SHA256": 274,
        "domain": 102,
        "email": 1,
        "FileHash-MD5": 73,
        "FileHash-SHA1": 65,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 1817,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "154 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fa56f45f0516a0b3075e7b",
      "name": "EbeeOct2025 Pt3",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2025-11-22T16:03:43.896000",
      "created": "2025-10-23T16:25:24.750000",
      "tags": [],
      "references": [
        "Oct week.3.pdf"
      ],
      "public": 1,
      "adversary": "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 61,
        "CIDR": 2,
        "CVE": 3,
        "FileHash-MD5": 175,
        "FileHash-SHA1": 135,
        "FileHash-SHA256": 190,
        "URL": 42,
        "email": 8,
        "hostname": 48
      },
      "indicator_count": 664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "191 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9114c86c0defd1b41335e",
      "name": "Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe.",
      "description": "The Caminho Loader, identified by Arctic Wolf, is a sophisticated Brazilian-origin Loader-as-a-Service operation that employs Least Significant Bit (LSB) steganography to conceal malicious .NET payloads within image files hosted on legitimate platforms. Initial infection begins with spear-phishing emails that contain archived JavaScript or VBScript files, often using business-themed social engineering tactics. When executed, these scripts retrieve an obfuscated PowerShell payload that downloads steganographic images from services like archive.org, a digital archive known for its reputation and high availability.",
      "modified": "2025-11-21T17:01:54.389000",
      "created": "2025-10-22T17:15:56.137000",
      "tags": [
        "javascript",
        "caminho loader",
        "remcos rat",
        "powershell",
        "arctic wolf",
        "june",
        "katz stealer",
        "hashes",
        "urls",
        "sha256",
        "august",
        "xworm",
        "wolf",
        "loader",
        "ukraine",
        "phishing",
        "first",
        "remcos",
        "hunt",
        "path",
        "stealer",
        "virustotal",
        "media",
        "click",
        "error",
        "example",
        "date",
        "rats",
        "easy",
        "code",
        "persistence",
        "lost",
        "bmp",
        "hta",
        "caminho",
        "katz"
      ],
      "references": [
        "https://arcticwolf.com/resources/blog/brazilian-caminho-loader-employs-lsb-steganography-to-deliver-multiple-malware-families/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Brazil",
        "South Africa",
        "Ukraine",
        "Poland",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Caminho Loader",
          "display_name": "Caminho Loader",
          "target": null
        },
        {
          "id": "Caminho",
          "display_name": "Caminho",
          "target": null
        },
        {
          "id": "XWorm",
          "display_name": "XWorm",
          "target": null
        },
        {
          "id": "Katz",
          "display_name": "Katz",
          "target": null
        },
        {
          "id": "REMCOS",
          "display_name": "REMCOS",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1559",
          "name": "Inter-Process Communication",
          "display_name": "T1559 - Inter-Process Communication"
        }
      ],
      "industries": [
        "Critical Infrastructure"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-MD5": 18,
        "FileHash-SHA1": 17,
        "FileHash-SHA256": 23,
        "domain": 5
      },
      "indicator_count": 64,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "192 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "virtualine.org",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "virtualine.org",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780358560.4320178
}