{ "type": "Domain", "indicator": "visualmed.org", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/visualmed.org", "alexa": "http://www.alexa.com/siteinfo/visualmed.org", "indicator": "visualmed.org", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3678800542, "indicator": "visualmed.org", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69dd91ae78f490fd44e82d33", "name": "URLert Daily Threat Intel \u2014 2026-04-14", "description": "URLert Daily Threat Intel \u2014 2026-04-14\n\nAutomated threat intelligence from URLert (https://urlert.com) \u2014 AI-powered URL and domain analysis.\n\nThreats: 67 | Indicators: 113\nConfirmed: 27 | Likely: 38 | Domain intel: 2\nTop threats: Phishing (49), Malware Hosting (12), Malvertising (3), Dropper (2), Exploit Kit (1)\nDomains: 738833.com, 888-gpifc.vip, 964235.help, 9mod.cloud, ankergames.net, appinjects.com, asusnext.us, binance-ltd.vip, bnz-gov.cam, bucara.my.id, bunnyband.com, challengermode.network, clck.ru,...\n\n67 unique threats producing 113 actionable indicators. Generated by URLert automated threat intelligence.", "modified": "2026-05-14T01:05:16.798000", "created": "2026-04-14T01:00:29.601000", "tags": [ ".monster-tld", "abused-platform", "account-takeover", "account-theft", "ad-fraud", "adult-content-scam", "adult-dating-scam", "advance-fee-fraud", "ai-services", "android-malware", "anti-analysis", "apk-distribution", "apk-malware", "asset-theft", "automated-scan", "binance-impersonation", "brand-impersonation", "brazil", "broken-page", "carding", "city-of-vancouver", "click-jacking", "cloud-run", "combosquatting", "community-report", "content-locker", "counterfeit-domain", "credential-harvesting", "cryptocurrency", "cryptocurrency-scam", "daily-threat-intel", "data-collection", "data-harvesting", "deceptive-content", "deceptive-domain", "deceptive-interface", "deceptive-lure", "deceptive-page", "deceptive-platform", "deceptive-practices", "deceptive-redirects", "deceptive-site", "deceptive-url", "deceptive-verification", "developer-tools-blocking", "domain-classification", "e-commerce-fraud", "earning-scheme", "esports-targeting", "etsy-impersonation", "evasion", "evasion-tactics", "fake-android-app", "fake-app", "fake-domain", "fake-giveaway", "fake-online-store", "fake-platform", "fake-rewards", "fake-verification", "file-sharing", "file-sharing-impersonation", "financial-fraud", "financial-harvesting", "financial-scam", "fiverr", "fiverr-impersonation", "flhsmv-impersonation", "fraudulent-activity", "fraudulent-platform", "fraudulent-scheme", "free-fire", "gambling", "gambling-promotion", "game-cheats", "get-paid-to-scheme", "google-impersonation", "government-impersonation", "high-risk-domain", "high-risk-tld", "information-gathering", "information-harvesting", "intrusive-ads", "investment-management", "investment-scam", "jadlog-impersonation", "low-reputation", "malicious-landing-page", "malicious-redirect", "malicious-redirection", "malvertising", "malware", "malware-distribution", "malware-download", "malware-hosting", "malware-potential", "mexc-impersonation", "misleading-domain", "mobile-spyware", "modified-apps", "nebula-x", "netlify-abuse", "new-domain", "newly-registered-domain", "obfuscation", "payment-information-harvesting", "payment-scam", "personal-data-collection", "personal-information-collection", "personal-information-harvesting", "pet-scam", "phishing", "phishing-page", "phishing-scam", "phishing-site", "phishing-technique", "pirated-software", "ponzi-scheme", "puppy-scam", "recruitment-scam", "redirect", "redirect-chain", "revanced-impersonation", "roblox", "roblox-impersonation", "scam", "scam-campaign", "scam-lure", "scam-site", "serviceontario", "session-token", "shopping-cart-scam", "signup-page", "signup-scam", "social-engineering", "spam-promotion", "spoofed-domain", "spotify", "steam", "survey-scam", "suspicious-retailer", "suspicious-service-model", "task-based-earning-scam", "task-based-scam", "task-scam", "third-party-download", "toll-scam", "typosquatting", "unofficial-sources", "unwanted-software", "url-redirection", "url-shortener", "urlert", "usdt-storage", "user-manipulation", "virtual-tasks", "wallet-harvesting", "x-twitter", "zip-download" ], "references": [ "https://urlert.com/domain/738833.com", "https://urlert.com/domain/888-gpifc.vip", "https://urlert.com/domain/964235.help", "https://urlert.com/domain/9mod.cloud", "https://urlert.com/domain/ankergames.net", "https://urlert.com/domain/appinjects.com", "https://urlert.com/domain/asusnext.us", "https://urlert.com/domain/binance-ltd.vip", "https://urlert.com/domain/bnz-gov.cam", "https://urlert.com/domain/bucara.my.id", "https://urlert.com/domain/bunnyband.com", "https://urlert.com/domain/challengermode.network", "https://urlert.com/domain/clck.ru", "https://urlert.com/domain/cloudnext.pro", "https://urlert.com/domain/dattingrooms.com", "https://urlert.com/domain/discord-tracker.com", "https://urlert.com/domain/elricat.co.uk", "https://urlert.com/domain/f09poypkdea3.com", "https://urlert.com/domain/facebook.hk", "https://urlert.com/domain/gamenuv.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Financial Services", "Government", "Logistics / Supply Chain", "Media / Entertainment", "Retail / E-Commerce", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "urlert_intel", "id": "386175", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_386175/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 35, "URL": 40, "hostname": 13 }, "indicator_count": 88, "is_author": false, "is_subscribing": null, "subscriber_count": 30, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6492361520e56fe57e2c2870", "name": "URLHaus data - 20-06-2023", "description": "", "modified": "2023-07-20T23:00:37.991000", "created": "2023-06-20T23:28:21.809000", "tags": [ "elf", "Mozi", "32-bit", "mips", "arm", "mirai", "Adwind", "BB33", "geofenced", "js", "Qakbot", "USA", "PowerShellDiscordKeyLogger", "exe", "njRAT", "Obama269", "TR", "zip", "hajime", "AsyncRAT", "ASPXChopperWebShell", "dcrat", "7z", "remcos", "RUS", "dropped-by-PrivateLoader", "RedLineStealer", "VoidRAT", "1234", "Password-protected", "dropped-by-amadey", "Rhadamanthys", "AgentTesla", "encrypted", "RedLine", "dropped-by-SmokeLoader", "RaccoonStealer", "IRATA", "sh", "32", "64", "LaplasClipper", "CoinMiner", "motorola", "Pikabot", "gafgyt", "Quakbot", "shellscript", "Loki", "Formbook", "dll", "ua-ps", "qbot", "Tsunami" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 495, "hostname": 17 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1045 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6474a025e7830f86fcbda9ba", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.\n\nA DLL is a library file containing functions that can be used by more than one program at the same time. When an application is launched, it will attempt to load any required DLLs.\n\nIt does this by searching through specific Windows folders for the DLL and, when found, loads it. However, Windows applications will prioritize DLLs in the same folder as the executable, loading them before all others.", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-29T12:52:53.004000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 307, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 434, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6462be46411bb325b6da05e9", "name": "URLHaus data - 15-05-2023", "description": "", "modified": "2023-05-15T23:20:38.852000", "created": "2023-05-15T23:20:38.852000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "AsyncRAT", "exe", "mirai", "dropped-by-amadey", "hajime", "geofenced", "obama263", "Qakbot", "USA", "wsf", "zip", "dll", "BB28", "js", "1234", "7z", "Password-protected", "64-bit", "x86-64", "doc", "opendir", "ua-ps", "AgentTesla", "dropped-by-SmokeLoader", "RecordBreaker", "Formbook", "ascii", "NetSupport", "powershell", "ps1", "rat", "ps", "dropped-by-PrivateLoader", "xworm", "SocGholish", "TDS", "2023", "rar", "1375", "glupteba", "viaAmadey", "viaSmokeLoader", "unknown", "32", "RemcosRAT", "encrypted", "1515", "Ngioweb", "discord", "infostealer", "Vidar", "RedLine", "RedLineStealer", "Amadey" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 323, "domain": 544, "hostname": 10 }, "indicator_count": 1877, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "645c261ad41f7c286ea912d8", "name": "URLHaus data - 10-05-2023", "description": "", "modified": "2023-05-10T23:17:46.346000", "created": "2023-05-10T23:17:46.346000", "tags": [ "32", "exe", "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "SocGholish", "BB27", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "obama262", "wsf", "zip", "obama262", "dll", "sparc", "bashlite", "gafgyt", "PowerPC", "njRAT", "intel", "64", "renesas", "motorola", "kinsing", "script", "NanoCore", "1212", "Password-protected", "rar", "1515" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 157, "domain": 593, "hostname": 22 }, "indicator_count": 1772, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlert.com/domain/asusnext.us", "https://urlert.com/domain/binance-ltd.vip", "https://urlert.com/domain/738833.com", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://urlert.com/domain/ankergames.net", "https://urlert.com/domain/clck.ru", "https://urlert.com/domain/dattingrooms.com", "https://urlert.com/domain/discord-tracker.com", "https://urlhaus.abuse.ch/browse/", "https://urlert.com/domain/bunnyband.com", "https://urlert.com/domain/9mod.cloud", "https://urlert.com/domain/gamenuv.com", "https://urlert.com/domain/bucara.my.id", "https://urlert.com/domain/f09poypkdea3.com", "https://urlert.com/domain/cloudnext.pro", "https://urlert.com/domain/facebook.hk", "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://urlert.com/domain/964235.help", "https://urlert.com/domain/888-gpifc.vip", "https://urlert.com/domain/bnz-gov.cam", "https://urlert.com/domain/challengermode.network", "https://twitter.com/Cryptolaemus1/status/1658152178945601549", "https://urlert.com/domain/appinjects.com", "https://urlert.com/domain/elricat.co.uk" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [ "Retail / e-commerce", "Government", "Technology", "Logistics / supply chain", "Media / entertainment", "Financial services" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69dd91ae78f490fd44e82d33", "name": "URLert Daily Threat Intel \u2014 2026-04-14", "description": "URLert Daily Threat Intel \u2014 2026-04-14\n\nAutomated threat intelligence from URLert (https://urlert.com) \u2014 AI-powered URL and domain analysis.\n\nThreats: 67 | Indicators: 113\nConfirmed: 27 | Likely: 38 | Domain intel: 2\nTop threats: Phishing (49), Malware Hosting (12), Malvertising (3), Dropper (2), Exploit Kit (1)\nDomains: 738833.com, 888-gpifc.vip, 964235.help, 9mod.cloud, ankergames.net, appinjects.com, asusnext.us, binance-ltd.vip, bnz-gov.cam, bucara.my.id, bunnyband.com, challengermode.network, clck.ru,...\n\n67 unique threats producing 113 actionable indicators. Generated by URLert automated threat intelligence.", "modified": "2026-05-14T01:05:16.798000", "created": "2026-04-14T01:00:29.601000", "tags": [ ".monster-tld", "abused-platform", "account-takeover", "account-theft", "ad-fraud", "adult-content-scam", "adult-dating-scam", "advance-fee-fraud", "ai-services", "android-malware", "anti-analysis", "apk-distribution", "apk-malware", "asset-theft", "automated-scan", "binance-impersonation", "brand-impersonation", "brazil", "broken-page", "carding", "city-of-vancouver", "click-jacking", "cloud-run", "combosquatting", "community-report", "content-locker", "counterfeit-domain", "credential-harvesting", "cryptocurrency", "cryptocurrency-scam", "daily-threat-intel", "data-collection", "data-harvesting", "deceptive-content", "deceptive-domain", "deceptive-interface", "deceptive-lure", "deceptive-page", "deceptive-platform", "deceptive-practices", "deceptive-redirects", "deceptive-site", "deceptive-url", "deceptive-verification", "developer-tools-blocking", "domain-classification", "e-commerce-fraud", "earning-scheme", "esports-targeting", "etsy-impersonation", "evasion", "evasion-tactics", "fake-android-app", "fake-app", "fake-domain", "fake-giveaway", "fake-online-store", "fake-platform", "fake-rewards", "fake-verification", "file-sharing", "file-sharing-impersonation", "financial-fraud", "financial-harvesting", "financial-scam", "fiverr", "fiverr-impersonation", "flhsmv-impersonation", "fraudulent-activity", "fraudulent-platform", "fraudulent-scheme", "free-fire", "gambling", "gambling-promotion", "game-cheats", "get-paid-to-scheme", "google-impersonation", "government-impersonation", "high-risk-domain", "high-risk-tld", "information-gathering", "information-harvesting", "intrusive-ads", "investment-management", "investment-scam", "jadlog-impersonation", "low-reputation", "malicious-landing-page", "malicious-redirect", "malicious-redirection", "malvertising", "malware", "malware-distribution", "malware-download", "malware-hosting", "malware-potential", "mexc-impersonation", "misleading-domain", "mobile-spyware", "modified-apps", "nebula-x", "netlify-abuse", "new-domain", "newly-registered-domain", "obfuscation", "payment-information-harvesting", "payment-scam", "personal-data-collection", "personal-information-collection", "personal-information-harvesting", "pet-scam", "phishing", "phishing-page", "phishing-scam", "phishing-site", "phishing-technique", "pirated-software", "ponzi-scheme", "puppy-scam", "recruitment-scam", "redirect", "redirect-chain", "revanced-impersonation", "roblox", "roblox-impersonation", "scam", "scam-campaign", "scam-lure", "scam-site", "serviceontario", "session-token", "shopping-cart-scam", "signup-page", "signup-scam", "social-engineering", "spam-promotion", "spoofed-domain", "spotify", "steam", "survey-scam", "suspicious-retailer", "suspicious-service-model", "task-based-earning-scam", "task-based-scam", "task-scam", "third-party-download", "toll-scam", "typosquatting", "unofficial-sources", "unwanted-software", "url-redirection", "url-shortener", "urlert", "usdt-storage", "user-manipulation", "virtual-tasks", "wallet-harvesting", "x-twitter", "zip-download" ], "references": [ "https://urlert.com/domain/738833.com", "https://urlert.com/domain/888-gpifc.vip", "https://urlert.com/domain/964235.help", "https://urlert.com/domain/9mod.cloud", "https://urlert.com/domain/ankergames.net", "https://urlert.com/domain/appinjects.com", "https://urlert.com/domain/asusnext.us", "https://urlert.com/domain/binance-ltd.vip", "https://urlert.com/domain/bnz-gov.cam", "https://urlert.com/domain/bucara.my.id", "https://urlert.com/domain/bunnyband.com", "https://urlert.com/domain/challengermode.network", "https://urlert.com/domain/clck.ru", "https://urlert.com/domain/cloudnext.pro", "https://urlert.com/domain/dattingrooms.com", "https://urlert.com/domain/discord-tracker.com", "https://urlert.com/domain/elricat.co.uk", "https://urlert.com/domain/f09poypkdea3.com", "https://urlert.com/domain/facebook.hk", "https://urlert.com/domain/gamenuv.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Financial Services", "Government", "Logistics / Supply Chain", "Media / Entertainment", "Retail / E-Commerce", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "urlert_intel", "id": "386175", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_386175/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 35, "URL": 40, "hostname": 13 }, "indicator_count": 88, "is_author": false, "is_subscribing": null, "subscriber_count": 30, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6492361520e56fe57e2c2870", "name": "URLHaus data - 20-06-2023", "description": "", "modified": "2023-07-20T23:00:37.991000", "created": "2023-06-20T23:28:21.809000", "tags": [ "elf", "Mozi", "32-bit", "mips", "arm", "mirai", "Adwind", "BB33", "geofenced", "js", "Qakbot", "USA", "PowerShellDiscordKeyLogger", "exe", "njRAT", "Obama269", "TR", "zip", "hajime", "AsyncRAT", "ASPXChopperWebShell", "dcrat", "7z", "remcos", "RUS", "dropped-by-PrivateLoader", "RedLineStealer", "VoidRAT", "1234", "Password-protected", "dropped-by-amadey", "Rhadamanthys", "AgentTesla", "encrypted", "RedLine", "dropped-by-SmokeLoader", "RaccoonStealer", "IRATA", "sh", "32", "64", "LaplasClipper", "CoinMiner", "motorola", "Pikabot", "gafgyt", "Quakbot", "shellscript", "Loki", "Formbook", "dll", "ua-ps", "qbot", "Tsunami" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 495, "hostname": 17 }, "indicator_count": 1512, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1045 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6474a025e7830f86fcbda9ba", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.\n\nA DLL is a library file containing functions that can be used by more than one program at the same time. When an application is launched, it will attempt to load any required DLLs.\n\nIt does this by searching through specific Windows folders for the DLL and, when found, loads it. However, Windows applications will prioritize DLLs in the same folder as the executable, loading them before all others.", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-29T12:52:53.004000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 307, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dekaRituraj", "id": "99856", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 434, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647610098b9502588eee94d2", "name": "QBot malware abuses Windows WordPad EXE to infect devices", "description": "", "modified": "2023-06-28T12:05:32.597000", "created": "2023-05-30T15:02:33.979000", "tags": [ "path", "span", "script", "button", "link", "header dropdown", "github", "footer", "template", "product", "form", "meta", "copy", "code", "qakbot", "enterprise", "open", "reload", "body", "find", "write", "star", "close", "desktop", "encodedcommand", "main" ], "references": [ "https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB28_15.05.2023.txt", "https://www.bleepingcomputer.com/news/security/qbot-malware-abuses-windows-wordpad-exe-to-infect-devices/", "https://twitter.com/Cryptolaemus1/status/1658152178945601549" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6474a025e7830f86fcbda9ba", "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OtpNgGim", "id": "207976", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 630, "FileHash-MD5": 1, "FileHash-SHA1": 3, "FileHash-SHA256": 20, "domain": 506 }, "indicator_count": 1160, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1067 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6462be46411bb325b6da05e9", "name": "URLHaus data - 15-05-2023", "description": "", "modified": "2023-05-15T23:20:38.852000", "created": "2023-05-15T23:20:38.852000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "AsyncRAT", "exe", "mirai", "dropped-by-amadey", "hajime", "geofenced", "obama263", "Qakbot", "USA", "wsf", "zip", "dll", "BB28", "js", "1234", "7z", "Password-protected", "64-bit", "x86-64", "doc", "opendir", "ua-ps", "AgentTesla", "dropped-by-SmokeLoader", "RecordBreaker", "Formbook", "ascii", "NetSupport", "powershell", "ps1", "rat", "ps", "dropped-by-PrivateLoader", "xworm", "SocGholish", "TDS", "2023", "rar", "1375", "glupteba", "viaAmadey", "viaSmokeLoader", "unknown", "32", "RemcosRAT", "encrypted", "1515", "Ngioweb", "discord", "infostealer", "Vidar", "RedLine", "RedLineStealer", "Amadey" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 323, "domain": 544, "hostname": 10 }, "indicator_count": 1877, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "645c261ad41f7c286ea912d8", "name": "URLHaus data - 10-05-2023", "description": "", "modified": "2023-05-10T23:17:46.346000", "created": "2023-05-10T23:17:46.346000", "tags": [ "32", "exe", "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "SocGholish", "BB27", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA", "obama262", "wsf", "zip", "obama262", "dll", "sparc", "bashlite", "gafgyt", "PowerPC", "njRAT", "intel", "64", "renesas", "motorola", "kinsing", "script", "NanoCore", "1212", "Password-protected", "rar", "1515" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "IPv4": 157, "domain": 593, "hostname": 22 }, "indicator_count": 1772, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "1116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "visualmed.org", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "visualmed.org", "found": true, "verdict": "malicious", "url_count": 4, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://visualmed.org/ud/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-06-20", "tags": [ "BB33", "geofenced", "js", "Qakbot", "USA" ] }, { "url": "https://visualmed.org/us/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-16", "tags": [ "BB28", "geofenced", "js", "Qakbot", "Quakbot", "USA" ] }, { "url": "https://visualmed.org/lpne/?1", "status": "offline", "threat": "malware_download", "date_added": "2023-05-15", "tags": [ "BB28", "geofenced", "js", "Qakbot", "Quakbot", "USA" ] }, { "url": "https://visualmed.org/ur/", "status": "offline", "threat": "malware_download", "date_added": "2023-05-10", "tags": [ "BB27", "geofenced", "js", "Qakbot", "qbot", "Quakbot", "TR", "USA" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780214732.117652 }