ThreatFox IOC Database
You are viewing the ThreatFox database entry for domain franmhort.duia.ro.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 08:57:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 696908 |
|---|---|
| IOC: | franmhort.duia.ro |
| IOC Type : | domain |
| Threat Type : | botnet_cc |
| Malware: | Vjw0rm |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2022-06-13 03:48:47 UTC |
| Last seen: | 2023-09-10 21:57:36 UTC |
| UUID: | baa5e9ed-eacb-11ec-a975-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | Houdini Vjw0rm WSHRAT |
| Reference: | https://tria.ge/220613-d169gsdeen |
AndreGironda
MITRE T1566.001Date: Sun, 12 Jun 2022 22:00-22:30 -0500
Received: from mailsv01.psysnet.com (210.230.250.137)
Content-Type: multipart/mixed; boundary="===============0103115937=="
MIME-Version: 1.0
Subject: Re: Urgent Order pricelist
To: Recipients <Kim.j@cowellfashion.co.kr>
From: " Kim Ghazali / Sales" <Kim.j@cowellfashion.co.kr>
X-AV-Checked: anti-virus scanned: PSYSNET.COM
Message-ID: <8552b5bf-b45e-4cdc-8213-00889b27a7ec@CO1NAM11FT047.eop-nam11.prod.protection.outlook.com>
Return-Path: Kim.j@cowellfashion.co.kr
Attachment Name: NEW-PO.zip
Zipfile SHA256: 7dc271ee8fea7c64942a7b5acd13b5ccf139e6dd910883b029288b77f1a642a3
Unzipped JavaScript Dropper Name: NEW-PO.js
JS Dropper SHA256: 9446c38b335edc7d0dbfa754ad0a8f1a41de185f83722b43816b739c3ceb74f4
VjW0rm SHA256: 3fcc843e8735f172c8746f473f042cc7bf796cad0b25f4d2e210251e206f9b43
WSHRAT / Houdini RAT SHA256: 185182f369edcb96118a91dcad39eb5b63239112ed6963a8c274178bf1b55394