{ "type": "Domain", "indicator": "win11install.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/win11install.com", "alexa": "http://www.alexa.com/siteinfo/win11install.com", "indicator": "win11install.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3451688536, "indicator": "win11install.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 33, "pulses": [ { "id": "62876ce0115d3177c23d5d74", "name": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "description": "Zscaler delivers the world\u2019s largest security platform built for the cloud, with the aim of delivering a zero trust approach to safeguarding your enterprise and protecting users from phishing, ransomware and other attacks.", "modified": "2022-07-29T06:16:13.471000", "created": "2022-05-20T10:26:39.611000", "tags": [ "vidar", "telegram", "mastodon", "adobe photoshop", "iso file", "md5 hash", "themida" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vidar", "display_name": "Vidar", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 309, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 11, "FileHash-SHA1": 6, "FileHash-SHA256": 6, "URL": 3, "domain": 5, "hostname": 1 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 386778, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03437b3d951543f94668b", "name": "Phishing | Mar 11, 2026 | Part 398/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 398/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:09:43.821000", "created": "2026-03-10T15:09:43.821000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 946, "hostname": 1053 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aee06acbe13a76ee2724a1", "name": "Phishing | Mar 10, 2026 | Part 348/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 348/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:59:54.848000", "created": "2026-03-09T14:59:54.848000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1127, "domain": 872 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8d2f3280da5daed0d81c", "name": "Phishing | Mar 9, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:52:31.356000", "created": "2026-03-08T14:52:31.356000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 723, "hostname": 1276 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3c4a23ce092ae7e81f3f", "name": "Phishing | Mar 8, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:55:06.140000", "created": "2026-03-07T14:55:06.140000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 723, "hostname": 1276 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aaea6be949f4d8953071b6", "name": "Phishing | Mar 7, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:53:31.521000", "created": "2026-03-06T14:53:31.521000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 724, "hostname": 1275 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99e549f0ca07eb713c70a", "name": "Phishing | Mar 6, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:16:36.517000", "created": "2026-03-05T15:16:36.517000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 722, "hostname": 1277 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8479c8bac86670df1a2f4", "name": "Phishing | Mar 5, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:54:20.456000", "created": "2026-03-04T14:54:20.456000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1278, "domain": 721 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f4e115cac0453440458b", "name": "Phishing | Mar 4, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:49:05.453000", "created": "2026-03-03T14:49:05.453000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 721, "hostname": 1278 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5badd0ec09b4d737f4524", "name": "Phishing | Mar 3, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:29:17.487000", "created": "2026-03-02T16:29:17.487000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1278, "domain": 721 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a518ed4e30fb6547e0332b", "name": "Phishing | Mar 2, 2026 | Part 351/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 351/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:58:21.464000", "created": "2026-03-02T04:58:21.464000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1279, "domain": 720 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a4458f7c12037d8590e726", "name": "Phishing | Mar 2, 2026 | Part 354/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 354/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:56:31.806000", "created": "2026-03-01T13:56:31.806000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1108, "domain": 891 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a40b39ef068a677917f650", "name": "Phishing | Mar 1, 2026 | Part 354/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 354/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:47:37.250000", "created": "2026-03-01T09:47:37.250000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1108, "domain": 891 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a389c5100946f633085815", "name": "Phishing | Mar 1, 2026 | Part 355/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 355/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:35:17.242000", "created": "2026-03-01T00:35:17.242000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 949, "hostname": 1050 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6998006fdc93fedf78731787", "name": "Phishing | Feb 20, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:34:23.054000", "created": "2026-02-20T06:34:23.054000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1105, "hostname": 894 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976e4ca004f8524b12e8d3", "name": "Phishing | Feb 20, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T20:10:52.761000", "created": "2026-02-19T20:10:52.761000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1105, "hostname": 894 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972f4c21af5432bcb5640f", "name": "Phishing | Feb 20, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:42:04.621000", "created": "2026-02-19T15:42:04.621000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1105, "hostname": 894 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970ff7727d663052ccb773", "name": "Phishing | Feb 19, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:28:23.867000", "created": "2026-02-19T13:28:23.867000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1106, "hostname": 893 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699639bdbf62156b26366bec", "name": "Phishing | Feb 19, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T22:14:21.167000", "created": "2026-02-18T22:14:21.167000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1106, "hostname": 893 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69957a6fc4a62bdb660c34e8", "name": "Phishing | Feb 18, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:38:07.255000", "created": "2026-02-18T08:38:07.255000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1107, "hostname": 892 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949eebb08c1d8a8cef1705", "name": "Phishing | Feb 18, 2026 | Part 357/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 357/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T17:01:31.928000", "created": "2026-02-17T17:01:31.928000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1107, "hostname": 892 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69929cf7e645fd483bc3fff8", "name": "Phishing | Feb 16, 2026 | Part 363/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 363/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:28:39.916000", "created": "2026-02-16T04:28:39.916000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1219, "domain": 780 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69915dd58d804ca26db42f35", "name": "Phishing | Feb 15, 2026 | Part 371/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 371/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:47:01.168000", "created": "2026-02-15T05:47:01.168000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1264, "domain": 735 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "106 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908f557793934e599c2173", "name": "Phishing | Feb 15, 2026 | Part 375/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 375/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T15:05:57.530000", "created": "2026-02-14T15:05:57.530000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1155, "domain": 844 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "107 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c61e7106625237a8ac0f1", "name": "Phishing | Feb 11, 2026 | Part 403/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 403/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T11:03:03.605000", "created": "2026-02-11T11:03:03.605000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1023, "domain": 976 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "110 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981abb45e279f160479c967", "name": "Phishing | 2026-01-31 | Part 96/163", "description": "Phishing indicators. Date: 2026-01-31. Part 96/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T08:03:00.851000", "created": "2026-02-03T08:03:00.851000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 6185, "domain": 3814 }, "indicator_count": 9999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "118 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62ba584feaf2f0c6bd1870e5", "name": "Vidar Malware distributed using Fake Windows 11 Downloads", "description": "", "modified": "2022-07-28T00:02:14.384000", "created": "2022-06-28T01:24:31.951000", "tags": [], "references": [ "May 20th, 2022 - CryptoGen Cyber Threat Intelligence - Vidar Malware distributed using Fake Windows 11 Downloads.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 3, "domain": 6, "hostname": 2 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "1404 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6288847fc843f4acdbc62ad6", "name": "NewDom-6-20220521", "description": "ICANN-Dom", "modified": "2022-07-05T00:01:31.805000", "created": "2022-05-21T06:19:43.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1427 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "628c887dcc7ff5b7bff31593", "name": "Vidar Infostealer Distributed via Fake Windows 11 Downloads Through Telegram and Mastodon", "description": "In April 2022, researchers discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. The spoofed sites were created to distribute malicious ISO files which lead to a Vidar info stealer infection on the endpoint.\n\nISO file\nThe binary inside the ISO file is a PE32 binary. The size of the ISO file is not more than 300 MB, which helps the attackers evade network security products where there is a file size limitation in place. The binary inside the ISO file is digitally signed with a certificate by AVAST.", "modified": "2022-06-23T00:03:28.624000", "created": "2022-05-24T07:25:49.251000", "tags": [ "hashes md5", "urls", "actual c2s", "Malware", "Vidar Infostealer" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "Malware Advisory", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "SVThreatIntel", "id": "148120", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_148120/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "URL": 3, "domain": 6, "hostname": 3 }, "indicator_count": 16, "is_author": false, "is_subscribing": null, "subscriber_count": 190, "modified_text": "1439 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62886ec5dc08708199ea1792", "name": "Vidar Malware distribution via Fake Windows 11 Downloads", "description": "Recently, multiple malicious domains are attempting to lull users into downloading trojan malware into their system, specifically Vidar malware, through impersonating as Microsoft Windows 11 download portals. Vidar malware is an info-stealer and is capable of defense evasion and command-and-control (C2) communication.", "modified": "2022-06-20T04:02:21.440000", "created": "2022-05-21T04:47:01.340000", "tags": [], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027.001", "name": "Binary Padding", "display_name": "T1027.001 - Binary Padding" }, { "id": "T1036.001", "name": "Invalid Code Signature", "display_name": "T1036.001 - Invalid Code Signature" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 191, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Provintell-Lab", "id": "112104", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 3, "URL": 1, "domain": 5, "hostname": 1, "FileHash-MD5": 4 }, "indicator_count": 14, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62873cd0229f2094eaebec14", "name": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "description": "Zscaler delivers the world\u2019s largest security platform built for the cloud, with the aim of delivering a zero trust approach to safeguarding your enterprise and protecting users from phishing, ransomware and other attacks.", "modified": "2022-06-19T00:05:22.053000", "created": "2022-05-20T07:01:36.496000", "tags": [ "vidar", "telegram", "c2 ip", "mastodon", "threatlabz", "vidar malware", "adobe photoshop", "iso file", "md5 hash", "from", "desktop", "april", "themida", "pass" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vidar", "display_name": "Vidar", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8, "FileHash-MD5": 13, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "domain": 6, "hostname": 2 }, "indicator_count": 45, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1443 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6286703c6be1b4e192279529", "name": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram | Zscaler", "description": "Zscaler delivers the world\u2019s largest security platform built for the cloud, with the aim of delivering a zero trust approach to safeguarding your enterprise and protecting users from phishing, ransomware and other attacks.", "modified": "2022-06-18T00:01:29.070000", "created": "2022-05-19T16:28:44.227000", "tags": [ "vidar", "telegram", "c2 ip", "mastodon", "threatlabz", "vidar malware", "adobe photoshop", "iso file", "md5 hash", "from", "desktop", "april", "themida", "pass" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vidar", "display_name": "Vidar", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "nsmteam2", "id": "182042", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 13, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 4, "domain": 6, "hostname": 2 }, "indicator_count": 41, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "1444 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62985ac0cced5c6e81556f2c", "name": "Vidar\u5bb6\u65cf\u6b63\u5728\u5229\u7528\u793e\u4f1a\u5de5\u7a0b\u5b66\u8fdb\u884c\u5206\u53d1", "description": "\u8fd1\u65e5\uff0cThreatLabz\u5206\u6790\u4e86Vidar\u5bb6\u65cf\u7684\u6280\u672f\u7279\u70b9\uff0c\u5176\u5b9e\u65e9\u57282022\u5e744\u6708\uff0cThreatLabz\u5c31\u53d1\u73b0\u4e86\u51e0\u4e2a\u65b0\u6ce8\u518c\u7684\u57df\uff0c\u8fd9\u4e9b\u57df\u662f\u7531\u653b\u51fb\u521b\u5efa\u7684\uff0c\u76ee\u7684\u662f\u5192\u5145\u5b98\u65b9\u7684Microsoft Windows 11\u64cd\u4f5c\u7cfb\u7edf\u4e0b\u8f7d\u95e8\u6237\uff0cThreatLabz \u8ba4\u4e3a\uff0cVidar\u5bb6\u65cf\u6b63\u5728\u79ef\u6781\u5229\u7528\u793e\u4f1a\u5de5\u7a0b\u6765\u5192\u5145\u6d41\u884c\u7684\u5408\u6cd5\u8f6f\u4ef6\u5e94\u7528\u7a0b\u5e8f\u6765\u5206\u53d1\u6076\u610f\u8f6f\u4ef6\uff0cThreatLabz\u53d1\u73b0\u4e86\u4e00\u4e2a\u7531\u653b\u51fb\u8005\u63a7\u5236\u7684GitHub \u5b58\u50a8\u5e93\uff0c\u5176\u4e2d\u6258\u7ba1\u4e86\u591a\u4e2aAdobe Photoshop\u540e\u95e8\u7248\u672c\uff0c\u8fd9\u4e9b\u6258\u7ba1\u5728 GitHub\u4e0a\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u4f7f\u7528\u7c7b\u4f3c\u7684\u7b56\u7565\u5206\u53d1Vidar \u6076\u610f\u8f6f\u4ef6\uff0c\u5373\u6ee5\u7528\u793e\u4ea4\u5a92\u4f53\u8fdb\u884cC2 \u901a\u4fe1\u3002", "modified": "2022-06-02T06:37:52.432000", "created": "2022-06-02T06:37:52.432000", "tags": [ "vidar", "telegram", "c2 ip", "mastodon", "threatlabz", "vidar malware", "adobe photoshop", "iso file", "md5 hash", "from", "desktop", "april", "themida", "pass", "HotSpot" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vidar", "display_name": "Vidar", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "sd123456", "id": "172789", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3, "domain": 5, "hostname": 1 }, "indicator_count": 9, "is_author": false, "is_subscribing": null, "subscriber_count": 45, "modified_text": "1460 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://ltna.com.au/cyber", "May 20th, 2022 - CryptoGen Cyber Threat Intelligence - Vidar Malware distributed using Fake Windows 11 Downloads.pdf", "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Vidar" ], "industries": [] }, "other": { "adversary": [ "Malware Advisory" ], "malware_families": [ "Vidar" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 33, "pulses": [ { "id": "62876ce0115d3177c23d5d74", "name": "Vidar distributed through backdoored Windows 11 downloads and abusing Telegram", "description": "Zscaler delivers the world\u2019s largest security platform built for the cloud, with the aim of delivering a zero trust approach to safeguarding your enterprise and protecting users from phishing, ransomware and other attacks.", "modified": "2022-07-29T06:16:13.471000", "created": "2022-05-20T10:26:39.611000", "tags": [ "vidar", "telegram", "mastodon", "adobe photoshop", "iso file", "md5 hash", "themida" ], "references": [ "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vidar", "display_name": "Vidar", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 309, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 11, "FileHash-SHA1": 6, "FileHash-SHA256": 6, "URL": 3, "domain": 5, "hostname": 1 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 386778, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03437b3d951543f94668b", "name": "Phishing | Mar 11, 2026 | Part 398/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 398/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:09:43.821000", "created": "2026-03-10T15:09:43.821000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 946, "hostname": 1053 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aee06acbe13a76ee2724a1", "name": "Phishing | Mar 10, 2026 | Part 348/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 348/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:59:54.848000", "created": "2026-03-09T14:59:54.848000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1127, "domain": 872 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8d2f3280da5daed0d81c", "name": "Phishing | Mar 9, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:52:31.356000", "created": "2026-03-08T14:52:31.356000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 723, "hostname": 1276 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3c4a23ce092ae7e81f3f", "name": "Phishing | Mar 8, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:55:06.140000", "created": "2026-03-07T14:55:06.140000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 723, "hostname": 1276 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aaea6be949f4d8953071b6", "name": "Phishing | Mar 7, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:53:31.521000", "created": "2026-03-06T14:53:31.521000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 724, "hostname": 1275 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99e549f0ca07eb713c70a", "name": "Phishing | Mar 6, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:16:36.517000", "created": "2026-03-05T15:16:36.517000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 722, "hostname": 1277 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8479c8bac86670df1a2f4", "name": "Phishing | Mar 5, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:54:20.456000", "created": "2026-03-04T14:54:20.456000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1278, "domain": 721 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f4e115cac0453440458b", "name": "Phishing | Mar 4, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:49:05.453000", "created": "2026-03-03T14:49:05.453000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 721, "hostname": 1278 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5badd0ec09b4d737f4524", "name": "Phishing | Mar 3, 2026 | Part 349/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 349/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:29:17.487000", "created": "2026-03-02T16:29:17.487000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1278, "domain": 721 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "win11install.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "win11install.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780357938.3039734 }