Skip to main content

ThreatFox IOCs for 2025-01-17

Medium
Published: Fri Jan 17 2025 (01/17/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint

Description

ThreatFox IOCs for 2025-01-17

AI-Powered Analysis

AILast updated: 06/19/2025, 16:17:50 UTC

Technical Analysis

The provided threat information pertains to a malware-related intelligence report titled "ThreatFox IOCs for 2025-01-17," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The threat is categorized under "type:osint," indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit targeting particular software versions. No specific affected product versions or CWE identifiers are provided, and there are no patch links or known exploits in the wild associated with this report. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, suggesting moderate dissemination or availability of the IOCs. The absence of concrete technical indicators or detailed malware behavior limits the ability to perform a deep technical dissection. However, the classification as malware and the presence of IOCs imply that this report is intended to inform defenders about potential malicious activity or infrastructure observed around the date of publication. Given the lack of specific exploit details or affected software, this threat likely represents a collection of intelligence on emerging or ongoing malware campaigns rather than a novel vulnerability or exploit vector. The TLP (Traffic Light Protocol) white tag indicates that the information is intended for unrestricted sharing, facilitating broad dissemination among security teams and organizations.

Potential Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the medium severity rating and the lack of known active exploitation. Since the threat intelligence revolves around IOCs related to malware, the primary risk lies in potential detection of malicious infrastructure or artifacts that could be used in targeted attacks or broader malware campaigns. Organizations that rely heavily on OSINT feeds for threat hunting and incident response may benefit from integrating these IOCs to enhance detection capabilities. However, without specific affected software or exploit mechanisms, the direct impact on confidentiality, integrity, or availability is limited at this stage. The threat could potentially facilitate reconnaissance or preparatory stages of attacks, which, if unmitigated, might lead to subsequent compromise. European entities in sectors with high exposure to malware threats—such as finance, critical infrastructure, and government—should remain vigilant. The broad distribution rating suggests that the malware or related infrastructure might be widespread, increasing the likelihood of encountering related threats in the European threat landscape.

Mitigation Recommendations

1. Integrate the provided IOCs into existing security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) platforms to enhance detection of related malicious activity. 2. Conduct proactive threat hunting exercises using the IOCs to identify any signs of compromise or reconnaissance within the network. 3. Maintain up-to-date malware detection signatures and heuristic analysis capabilities to detect variants or related malware campaigns. 4. Enhance user awareness training focusing on recognizing phishing and social engineering tactics that often accompany malware campaigns. 5. Employ network segmentation and strict access controls to limit lateral movement in case of infection. 6. Regularly review and update incident response plans to incorporate procedures for handling malware infections identified through OSINT feeds. 7. Collaborate with national and European cybersecurity information sharing organizations to stay informed about evolving threats and share relevant findings. 8. Since no patches are available, emphasize layered defense strategies including endpoint hardening, application whitelisting, and continuous monitoring.

Need more detailed analysis?Get Pro

Technical Details

Threat Level
2
Analysis
1
Distribution
3
Uuid
9b31eb1d-9bc0-4311-bd81-8f1ef48731bf
Original Timestamp
1737158585

Indicators of Compromise

File

ValueDescriptionCopy
file8.217.225.186
Cobalt Strike botnet C2 server (confidence level: 100%)
file47.109.178.54
Cobalt Strike botnet C2 server (confidence level: 100%)
file198.211.102.26
Sliver botnet C2 server (confidence level: 100%)
file193.143.1.72
AsyncRAT botnet C2 server (confidence level: 100%)
file193.143.1.72
AsyncRAT botnet C2 server (confidence level: 100%)
file88.243.168.51
AsyncRAT botnet C2 server (confidence level: 100%)
file94.72.118.139
AsyncRAT botnet C2 server (confidence level: 100%)
file3.12.166.27
Havoc botnet C2 server (confidence level: 100%)
file157.90.111.39
Havoc botnet C2 server (confidence level: 100%)
file185.137.132.31
Havoc botnet C2 server (confidence level: 100%)
file185.137.132.31
Havoc botnet C2 server (confidence level: 100%)
file46.246.84.11
DCRat botnet C2 server (confidence level: 100%)
file46.246.80.10
DCRat botnet C2 server (confidence level: 100%)
file46.246.12.18
DCRat botnet C2 server (confidence level: 100%)
file3.107.10.187
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file157.230.181.46
Brute Ratel C4 botnet C2 server (confidence level: 100%)
file94.156.167.70
ERMAC botnet C2 server (confidence level: 100%)
file51.142.11.238
Unknown malware botnet C2 server (confidence level: 100%)
file5.178.1.17
Cobalt Strike botnet C2 server (confidence level: 75%)
file59.110.136.135
Cobalt Strike botnet C2 server (confidence level: 100%)
file8.143.2.128
Cobalt Strike botnet C2 server (confidence level: 100%)
file213.142.159.30
Remcos botnet C2 server (confidence level: 100%)
file172.233.38.247
Sliver botnet C2 server (confidence level: 100%)
file155.138.162.190
ShadowPad botnet C2 server (confidence level: 90%)
file85.31.47.75
AsyncRAT botnet C2 server (confidence level: 100%)
file161.35.218.205
Unknown malware botnet C2 server (confidence level: 100%)
file198.167.199.206
Quasar RAT botnet C2 server (confidence level: 100%)
file194.107.126.35
Venom RAT botnet C2 server (confidence level: 100%)
file144.172.92.91
Unknown malware botnet C2 server (confidence level: 100%)
file208.91.189.202
AsyncRAT botnet C2 server (confidence level: 100%)
file45.83.31.62
AsyncRAT botnet C2 server (confidence level: 100%)
file54.186.132.100
Unknown malware botnet C2 server (confidence level: 100%)
file84.32.230.181
Venom RAT botnet C2 server (confidence level: 100%)
file193.124.45.30
Unknown malware botnet C2 server (confidence level: 100%)
file139.59.99.99
Unknown malware botnet C2 server (confidence level: 100%)
file209.74.79.209
Unknown malware botnet C2 server (confidence level: 100%)
file51.15.49.95
Unknown malware botnet C2 server (confidence level: 100%)
file154.26.132.197
Unknown malware botnet C2 server (confidence level: 100%)
file193.31.41.73
Unknown malware botnet C2 server (confidence level: 100%)
file193.227.178.151
Unknown malware botnet C2 server (confidence level: 100%)
file59.44.114.182
Unknown malware botnet C2 server (confidence level: 100%)
file3.68.58.3
Unknown malware botnet C2 server (confidence level: 100%)
file150.116.153.195
Unknown malware botnet C2 server (confidence level: 100%)
file139.99.98.117
Unknown malware botnet C2 server (confidence level: 100%)
file3.253.21.109
Unknown malware botnet C2 server (confidence level: 100%)
file143.110.152.144
Unknown malware botnet C2 server (confidence level: 100%)
file76.223.67.189
RedLine Stealer botnet C2 server (confidence level: 100%)
file185.171.21.203
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file13.202.78.26
Unknown malware botnet C2 server (confidence level: 50%)
file54.89.61.47
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file164.90.133.236
Unknown malware botnet C2 server (confidence level: 50%)
file8.219.86.28
Cobalt Strike botnet C2 server (confidence level: 50%)
file3.232.168.159
Cobalt Strike botnet C2 server (confidence level: 50%)
file149.154.68.20
Sliver botnet C2 server (confidence level: 50%)
file106.54.38.80
Sliver botnet C2 server (confidence level: 50%)
file172.96.172.172
AsyncRAT botnet C2 server (confidence level: 50%)
file45.58.126.14
AsyncRAT botnet C2 server (confidence level: 50%)
file93.177.102.208
Quasar RAT botnet C2 server (confidence level: 100%)
file206.238.42.151
ValleyRAT botnet C2 server (confidence level: 100%)
file181.131.216.206
AsyncRAT botnet C2 server (confidence level: 100%)
file5.75.234.8
Meterpreter botnet C2 server (confidence level: 100%)
file142.11.192.232
DanaBot botnet C2 server (confidence level: 100%)
file216.9.226.100
Remcos botnet C2 server (confidence level: 75%)
file101.133.238.18
Cobalt Strike botnet C2 server (confidence level: 75%)
file106.75.247.91
Cobalt Strike botnet C2 server (confidence level: 75%)
file137.184.111.45
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.156.177.41
Loki Password Stealer (PWS) botnet C2 server (confidence level: 50%)
file141.164.37.247
Cobalt Strike botnet C2 server (confidence level: 100%)
file95.216.181.179
Vidar botnet C2 server (confidence level: 100%)
file154.37.212.27
Cobalt Strike botnet C2 server (confidence level: 100%)
file87.121.86.203
Remcos botnet C2 server (confidence level: 100%)
file35.206.78.64
Sliver botnet C2 server (confidence level: 100%)
file155.138.214.192
Sliver botnet C2 server (confidence level: 100%)
file209.94.58.61
Sliver botnet C2 server (confidence level: 100%)
file47.237.86.35
Unknown malware botnet C2 server (confidence level: 100%)
file193.143.1.72
AsyncRAT botnet C2 server (confidence level: 100%)
file163.172.60.235
AsyncRAT botnet C2 server (confidence level: 100%)
file163.172.60.235
AsyncRAT botnet C2 server (confidence level: 100%)
file18.231.172.87
Unknown malware botnet C2 server (confidence level: 100%)
file139.84.164.133
Unknown malware botnet C2 server (confidence level: 100%)
file172.86.81.57
Quasar RAT botnet C2 server (confidence level: 100%)
file154.201.90.76
Kaiji botnet C2 server (confidence level: 100%)
file94.103.125.184
MooBot botnet C2 server (confidence level: 100%)
file103.164.76.42
Sliver botnet C2 server (confidence level: 75%)
file103.164.76.42
Sliver botnet C2 server (confidence level: 75%)
file103.164.76.42
Sliver botnet C2 server (confidence level: 75%)
file13.247.213.233
NetSupportManager RAT botnet C2 server (confidence level: 75%)
file180.97.214.74
DeimosC2 botnet C2 server (confidence level: 75%)
file38.150.7.206
DeimosC2 botnet C2 server (confidence level: 75%)
file111.231.5.58
ValleyRAT botnet C2 server (confidence level: 100%)
file104.238.61.144
RansomHub botnet C2 server (confidence level: 75%)
file104.238.61.144
RansomHub botnet C2 server (confidence level: 75%)
file108.181.115.171
RansomHub botnet C2 server (confidence level: 75%)
file108.181.115.171
RansomHub botnet C2 server (confidence level: 75%)
file108.181.182.143
RansomHub botnet C2 server (confidence level: 75%)
file108.181.182.143
RansomHub botnet C2 server (confidence level: 75%)
file185.174.101.240
RansomHub botnet C2 server (confidence level: 75%)
file185.174.101.240
RansomHub botnet C2 server (confidence level: 75%)
file185.174.101.69
RansomHub botnet C2 server (confidence level: 75%)
file185.174.101.69
RansomHub botnet C2 server (confidence level: 75%)
file104.21.235.114
Eye Pyramid botnet C2 server (confidence level: 75%)
file104.21.44.142
Eye Pyramid botnet C2 server (confidence level: 75%)
file146.70.87.141
Eye Pyramid botnet C2 server (confidence level: 75%)
file147.45.147.76
Eye Pyramid botnet C2 server (confidence level: 75%)
file167.99.139.231
Eye Pyramid botnet C2 server (confidence level: 75%)
file167.99.139.231
Eye Pyramid botnet C2 server (confidence level: 75%)
file18.191.75.16
Eye Pyramid botnet C2 server (confidence level: 75%)
file194.102.104.24
Eye Pyramid botnet C2 server (confidence level: 75%)
file194.102.104.25
Eye Pyramid botnet C2 server (confidence level: 75%)
file194.102.104.25
Eye Pyramid botnet C2 server (confidence level: 75%)
file195.160.221.194
Eye Pyramid botnet C2 server (confidence level: 75%)
file195.20.18.146
Eye Pyramid botnet C2 server (confidence level: 75%)
file23.227.193.172
RansomHub botnet C2 server (confidence level: 75%)
file23.227.193.172
RansomHub botnet C2 server (confidence level: 75%)
file37.1.212.18
RansomHub botnet C2 server (confidence level: 75%)
file37.1.212.18
RansomHub botnet C2 server (confidence level: 75%)
file38.132.122.156
Eye Pyramid botnet C2 server (confidence level: 75%)
file38.180.81.153
RansomHub botnet C2 server (confidence level: 75%)
file38.180.81.153
RansomHub botnet C2 server (confidence level: 75%)
file45.66.248.150
RansomHub botnet C2 server (confidence level: 75%)
file45.66.248.150
RansomHub botnet C2 server (confidence level: 75%)
file45.86.231.115
Eye Pyramid botnet C2 server (confidence level: 75%)
file5.8.63.178
RansomHub botnet C2 server (confidence level: 75%)
file62.76.251.43
Eye Pyramid botnet C2 server (confidence level: 75%)
file87.120.117.78
Eye Pyramid botnet C2 server (confidence level: 75%)
file88.119.175.65
RansomHub botnet C2 server (confidence level: 75%)
file88.119.175.65
RansomHub botnet C2 server (confidence level: 75%)
file88.119.175.70
RansomHub botnet C2 server (confidence level: 75%)
file88.119.175.70
RansomHub botnet C2 server (confidence level: 75%)
file92.118.112.143
RansomHub botnet C2 server (confidence level: 75%)
file92.118.112.143
RansomHub botnet C2 server (confidence level: 75%)
file92.118.112.208
RansomHub botnet C2 server (confidence level: 75%)
file92.118.112.208
RansomHub botnet C2 server (confidence level: 75%)
file93.123.72.42
Eye Pyramid botnet C2 server (confidence level: 75%)
file118.122.8.154
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file54.193.51.242
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file203.144.184.186
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file23.94.126.198
AsyncRAT botnet C2 server (confidence level: 50%)
file69.166.230.200
AsyncRAT botnet C2 server (confidence level: 50%)
file124.71.192.162
Cobalt Strike botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file5.252.153.178
XWorm botnet C2 server (confidence level: 100%)
file23.226.129.25
XWorm botnet C2 server (confidence level: 100%)
file45.138.16.245
XWorm botnet C2 server (confidence level: 100%)
file45.145.43.244
XWorm botnet C2 server (confidence level: 100%)
file87.247.158.212
XWorm botnet C2 server (confidence level: 100%)
file91.217.77.77
XWorm botnet C2 server (confidence level: 100%)
file94.124.192.220
XWorm botnet C2 server (confidence level: 100%)
file108.181.162.232
XWorm botnet C2 server (confidence level: 100%)
file137.184.74.73
XWorm botnet C2 server (confidence level: 100%)
file139.59.228.234
XWorm botnet C2 server (confidence level: 100%)
file166.88.185.67
XWorm botnet C2 server (confidence level: 100%)
file176.221.16.167
XWorm botnet C2 server (confidence level: 100%)
file157.20.182.24
Venom RAT botnet C2 server (confidence level: 100%)
file154.23.176.39
ValleyRAT botnet C2 server (confidence level: 100%)
file94.154.35.185
Mirai botnet C2 server (confidence level: 75%)
file45.144.136.169
Cobalt Strike botnet C2 server (confidence level: 100%)
file14.29.160.181
Cobalt Strike botnet C2 server (confidence level: 100%)
file52.194.253.134
ShadowPad botnet C2 server (confidence level: 90%)
file155.138.162.190
ShadowPad botnet C2 server (confidence level: 90%)
file129.211.173.74
Unknown malware botnet C2 server (confidence level: 100%)
file45.202.35.19
AsyncRAT botnet C2 server (confidence level: 100%)
file23.94.148.26
AsyncRAT botnet C2 server (confidence level: 100%)
file45.154.98.25
AsyncRAT botnet C2 server (confidence level: 100%)
file178.32.113.93
Havoc botnet C2 server (confidence level: 100%)
file159.65.47.237
Havoc botnet C2 server (confidence level: 100%)
file157.20.182.105
Venom RAT botnet C2 server (confidence level: 100%)
file157.20.182.177
Venom RAT botnet C2 server (confidence level: 100%)
file207.148.13.10
Venom RAT botnet C2 server (confidence level: 100%)
file198.50.242.157
Orcus RAT botnet C2 server (confidence level: 100%)
file45.135.232.38
DCRat botnet C2 server (confidence level: 100%)
file47.243.116.8
ValleyRAT botnet C2 server (confidence level: 100%)
file185.84.161.65
XWorm botnet C2 server (confidence level: 100%)
file147.185.221.25
XWorm botnet C2 server (confidence level: 100%)
file147.185.221.251
AsyncRAT botnet C2 server (confidence level: 100%)
file170.187.152.163
Cobalt Strike botnet C2 server (confidence level: 75%)
file18.132.46.179
Cobalt Strike botnet C2 server (confidence level: 75%)
file212.192.13.123
Cobalt Strike botnet C2 server (confidence level: 75%)
file77.244.91.17
Cobalt Strike botnet C2 server (confidence level: 75%)
file8.130.123.92
Cobalt Strike botnet C2 server (confidence level: 50%)
file193.57.57.121
Cobalt Strike botnet C2 server (confidence level: 50%)
file13.247.88.111
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file18.228.6.17
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file79.239.123.44
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file54.68.48.57
Unknown malware botnet C2 server (confidence level: 50%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file195.26.245.113
AsyncRAT botnet C2 server (confidence level: 100%)
file24.152.36.142
AsyncRAT botnet C2 server (confidence level: 100%)
file88.243.168.51
AsyncRAT botnet C2 server (confidence level: 100%)
file185.137.132.31
Havoc botnet C2 server (confidence level: 100%)
file3.69.19.106
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file3.69.19.106
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file168.100.10.68
Unknown malware botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file54.68.48.57
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file23.226.54.93
Sliver botnet C2 server (confidence level: 50%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file165.232.71.57
Cobalt Strike botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file98.83.165.75
Cobalt Strike botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file166.108.199.202
Cobalt Strike botnet C2 server (confidence level: 100%)
file103.234.72.165
Cobalt Strike botnet C2 server (confidence level: 100%)
file110.42.41.180
Cobalt Strike botnet C2 server (confidence level: 100%)
file175.27.229.102
Unknown malware botnet C2 server (confidence level: 100%)
file163.5.169.248
AsyncRAT botnet C2 server (confidence level: 100%)
file35.95.130.83
Unknown malware botnet C2 server (confidence level: 100%)
file46.246.86.14
DCRat botnet C2 server (confidence level: 100%)
file3.128.76.125
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file67.217.228.74
Unknown malware botnet C2 server (confidence level: 75%)
file45.61.136.48
Unknown malware botnet C2 server (confidence level: 75%)
file35.180.7.181
MimiKatz botnet C2 server (confidence level: 100%)
file94.198.40.6
BianLian botnet C2 server (confidence level: 100%)
file104.200.67.252
BianLian botnet C2 server (confidence level: 100%)
file109.242.118.213
QakBot botnet C2 server (confidence level: 75%)
file121.36.102.37
Viper RAT botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file78.168.170.187
QakBot botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file181.50.73.64
Unknown malware botnet C2 server (confidence level: 50%)
file54.68.48.57
Unknown malware botnet C2 server (confidence level: 50%)
file185.208.158.217
Sliver botnet C2 server (confidence level: 50%)
file89.23.113.134
Sliver botnet C2 server (confidence level: 50%)
file85.31.47.208
AsyncRAT botnet C2 server (confidence level: 50%)
file103.68.251.141
DarkComet botnet C2 server (confidence level: 50%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file45.77.46.13
Havoc botnet C2 server (confidence level: 75%)
file5.78.85.47
Havoc botnet C2 server (confidence level: 75%)
file62.68.75.16
Havoc botnet C2 server (confidence level: 75%)
file64.52.80.94
Meduza Stealer botnet C2 server (confidence level: 75%)
file66.42.98.90
pupy botnet C2 server (confidence level: 75%)
file80.76.49.97
Meduza Stealer botnet C2 server (confidence level: 75%)
file94.23.84.20
Sliver botnet C2 server (confidence level: 75%)
file20.5.43.62
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.77.10.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.13
Cobalt Strike botnet C2 server (confidence level: 75%)
file35.79.20.7
Cobalt Strike botnet C2 server (confidence level: 75%)
file51.96.90.80
Cobalt Strike botnet C2 server (confidence level: 75%)
file80.64.30.50
Cobalt Strike botnet C2 server (confidence level: 75%)
file81.70.49.19
Cobalt Strike botnet C2 server (confidence level: 75%)
file82.67.60.21
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)
file94.20.88.63
Cobalt Strike botnet C2 server (confidence level: 75%)

Hash

ValueDescriptionCopy
hash8443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash2222
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8443
Sliver botnet C2 server (confidence level: 100%)
hash443
AsyncRAT botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash80
Havoc botnet C2 server (confidence level: 100%)
hash81
Havoc botnet C2 server (confidence level: 100%)
hash80
Havoc botnet C2 server (confidence level: 100%)
hash443
Havoc botnet C2 server (confidence level: 100%)
hash9000
DCRat botnet C2 server (confidence level: 100%)
hash8080
DCRat botnet C2 server (confidence level: 100%)
hash8000
DCRat botnet C2 server (confidence level: 100%)
hash54254
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash8443
Brute Ratel C4 botnet C2 server (confidence level: 100%)
hash80
ERMAC botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash8080
Cobalt Strike botnet C2 server (confidence level: 75%)
hash3443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash65005
Cobalt Strike botnet C2 server (confidence level: 100%)
hash2404
Remcos botnet C2 server (confidence level: 100%)
hash443
Sliver botnet C2 server (confidence level: 100%)
hash80
ShadowPad botnet C2 server (confidence level: 90%)
hash1967
AsyncRAT botnet C2 server (confidence level: 100%)
hash445
Unknown malware botnet C2 server (confidence level: 100%)
hash19132
Quasar RAT botnet C2 server (confidence level: 100%)
hash2222
Venom RAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash7000
AsyncRAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash4449
Venom RAT botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash8443
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash1333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash9205
Unknown malware botnet C2 server (confidence level: 100%)
hash80
Unknown malware botnet C2 server (confidence level: 100%)
hash3334
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash443
Unknown malware botnet C2 server (confidence level: 100%)
hash80
RedLine Stealer botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 50%)
hash3128
Unknown malware botnet C2 server (confidence level: 50%)
hash443
Unknown malware botnet C2 server (confidence level: 50%)
hash5555
Unknown malware botnet C2 server (confidence level: 50%)
hash5555
Unknown malware botnet C2 server (confidence level: 50%)
hash5555
Unknown malware botnet C2 server (confidence level: 50%)
hash80
Cobalt Strike botnet C2 server (confidence level: 50%)
hash443
Cobalt Strike botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash5555
AsyncRAT botnet C2 server (confidence level: 50%)
hash5555
AsyncRAT botnet C2 server (confidence level: 50%)
hash1337
Quasar RAT botnet C2 server (confidence level: 100%)
hash17091
ValleyRAT botnet C2 server (confidence level: 100%)
hash8050
AsyncRAT botnet C2 server (confidence level: 100%)
hash5050
Meterpreter botnet C2 server (confidence level: 100%)
hash443
DanaBot botnet C2 server (confidence level: 100%)
hash3898
Remcos botnet C2 server (confidence level: 75%)
hash9002
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Loki Password Stealer (PWS) botnet C2 server (confidence level: 50%)
hash4444
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
Vidar botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash5977
Remcos botnet C2 server (confidence level: 100%)
hash443
Sliver botnet C2 server (confidence level: 100%)
hash4443
Sliver botnet C2 server (confidence level: 100%)
hash8081
Sliver botnet C2 server (confidence level: 100%)
hash3981
Unknown malware botnet C2 server (confidence level: 100%)
hash9090
AsyncRAT botnet C2 server (confidence level: 100%)
hash6606
AsyncRAT botnet C2 server (confidence level: 100%)
hash7707
AsyncRAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash443
Unknown malware botnet C2 server (confidence level: 100%)
hash443
Quasar RAT botnet C2 server (confidence level: 100%)
hash8520
Kaiji botnet C2 server (confidence level: 100%)
hash80
MooBot botnet C2 server (confidence level: 100%)
hash443
Sliver botnet C2 server (confidence level: 75%)
hash8443
Sliver botnet C2 server (confidence level: 75%)
hash8888
Sliver botnet C2 server (confidence level: 75%)
hash1098
NetSupportManager RAT botnet C2 server (confidence level: 75%)
hash4506
DeimosC2 botnet C2 server (confidence level: 75%)
hash443
DeimosC2 botnet C2 server (confidence level: 75%)
hash3307
ValleyRAT botnet C2 server (confidence level: 100%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash55555
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash8003
Eye Pyramid botnet C2 server (confidence level: 75%)
hash8004
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash80
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash1999
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash55555
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash1999
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8888
Eye Pyramid botnet C2 server (confidence level: 75%)
hash1999
RansomHub botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
RansomHub botnet C2 server (confidence level: 75%)
hash8000
RansomHub botnet C2 server (confidence level: 75%)
hash443
Eye Pyramid botnet C2 server (confidence level: 75%)
hash8139
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash7634
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash8594
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash5555
AsyncRAT botnet C2 server (confidence level: 50%)
hash5555
AsyncRAT botnet C2 server (confidence level: 50%)
hash50000
Cobalt Strike botnet C2 server (confidence level: 50%)
hash992
Unknown malware botnet C2 server (confidence level: 50%)
hash1488
XWorm botnet C2 server (confidence level: 100%)
hash5353
XWorm botnet C2 server (confidence level: 100%)
hash7122
XWorm botnet C2 server (confidence level: 100%)
hash1111
XWorm botnet C2 server (confidence level: 100%)
hash4444
XWorm botnet C2 server (confidence level: 100%)
hash7000
XWorm botnet C2 server (confidence level: 100%)
hash4443
XWorm botnet C2 server (confidence level: 100%)
hash1177
XWorm botnet C2 server (confidence level: 100%)
hash7000
XWorm botnet C2 server (confidence level: 100%)
hash22693
XWorm botnet C2 server (confidence level: 100%)
hash5353
XWorm botnet C2 server (confidence level: 100%)
hash7000
XWorm botnet C2 server (confidence level: 100%)
hash4449
Venom RAT botnet C2 server (confidence level: 100%)
hash4433
ValleyRAT botnet C2 server (confidence level: 100%)
hash3778
Mirai botnet C2 server (confidence level: 75%)
hash18443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash10080
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
ShadowPad botnet C2 server (confidence level: 90%)
hash8080
ShadowPad botnet C2 server (confidence level: 90%)
hash8888
Unknown malware botnet C2 server (confidence level: 100%)
hash7707
AsyncRAT botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash8444
AsyncRAT botnet C2 server (confidence level: 100%)
hash443
Havoc botnet C2 server (confidence level: 100%)
hash443
Havoc botnet C2 server (confidence level: 100%)
hash4449
Venom RAT botnet C2 server (confidence level: 100%)
hash4449
Venom RAT botnet C2 server (confidence level: 100%)
hash4449
Venom RAT botnet C2 server (confidence level: 100%)
hash3846
Orcus RAT botnet C2 server (confidence level: 100%)
hash35550
DCRat botnet C2 server (confidence level: 100%)
hash6666
ValleyRAT botnet C2 server (confidence level: 100%)
hash7000
XWorm botnet C2 server (confidence level: 100%)
hash18007
XWorm botnet C2 server (confidence level: 100%)
hash18020
AsyncRAT botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash8080
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 50%)
hash9443
Cobalt Strike botnet C2 server (confidence level: 50%)
hash1599
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash3299
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash554
Unknown malware botnet C2 server (confidence level: 50%)
hash1081
Unknown malware botnet C2 server (confidence level: 50%)
hash60022
Unknown malware botnet C2 server (confidence level: 50%)
hash80
Unknown malware botnet C2 server (confidence level: 50%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash1009
AsyncRAT botnet C2 server (confidence level: 100%)
hash8443
Havoc botnet C2 server (confidence level: 100%)
hash1244
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash18244
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash80
Unknown malware botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash59622
Unknown malware botnet C2 server (confidence level: 50%)
hash80
Unknown malware botnet C2 server (confidence level: 50%)
hash59722
Unknown malware botnet C2 server (confidence level: 50%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash888
Cobalt Strike botnet C2 server (confidence level: 100%)
hash31211
Cobalt Strike botnet C2 server (confidence level: 100%)
hash44444
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8888
Unknown malware botnet C2 server (confidence level: 100%)
hash1000
AsyncRAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash8080
DCRat botnet C2 server (confidence level: 100%)
hash10258
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash80
Unknown malware botnet C2 server (confidence level: 75%)
hash80
Unknown malware botnet C2 server (confidence level: 75%)
hash9999
MimiKatz botnet C2 server (confidence level: 100%)
hash20025
BianLian botnet C2 server (confidence level: 100%)
hash3966
BianLian botnet C2 server (confidence level: 100%)
hash995
QakBot botnet C2 server (confidence level: 75%)
hash60000
Viper RAT botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash443
QakBot botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash59822
Unknown malware botnet C2 server (confidence level: 50%)
hash59922
Unknown malware botnet C2 server (confidence level: 50%)
hash80
Unknown malware botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash444
AsyncRAT botnet C2 server (confidence level: 50%)
hash8443
DarkComet botnet C2 server (confidence level: 50%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Havoc botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash53
pupy botnet C2 server (confidence level: 75%)
hash80
Meduza Stealer botnet C2 server (confidence level: 75%)
hash80
Sliver botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash81
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash80
Cobalt Strike botnet C2 server (confidence level: 75%)

Url

ValueDescriptionCopy
urlhttps://79.137.203.19/7hgd5fx4/index.php
Amadey botnet C2 (confidence level: 100%)
urlhttps://human-verify.b-cdn.net/verify-captcha-v1.html
Lumma Stealer payload delivery URL (confidence level: 100%)
urlhttps://latyoutw.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://slopestarball.com/play.html
Lumma Stealer payload delivery URL (confidence level: 100%)
urlhttps://slopestarball.com
Lumma Stealer payload delivery URL (confidence level: 100%)
urlhttps://gardenfloristry.com/play.html
Lumma Stealer payload delivery URL (confidence level: 75%)
urlhttps://towercrash.com/play.html
Lumma Stealer payload delivery URL (confidence level: 75%)
urlhttps://omnomruns.com/play.html
Lumma Stealer payload delivery URL (confidence level: 75%)
urlhttps://anyigames.com/play.html
Lumma Stealer payload delivery URL (confidence level: 75%)
urlhttp://feheecfmkmhfiij.top/bayvz3wj7lhtr.php
Unknown malware botnet C2 (confidence level: 100%)
urlhttp://www.aoivej.info/tw6w/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.j53m3ks3.top/g91b/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cassino.legal/555c/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.voicecraft.pro/ezzc/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.outandaboutatlanta.net/m25n/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sonixingenuine.shop/8g6k/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.vh5g.sbs/5sb9/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.augier2619.top/t56x/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.topcaffe.shop/2nok/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.benettoniran.shop/g59t/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.leqko.club/6bxb/
Formbook botnet C2 (confidence level: 50%)
urlhttp://a1071976.xsph.ru/0cd6972b.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://chellebelledesigns.com/ponyb/gate.php
Pony botnet C2 (confidence level: 100%)
urlhttp://94.156.177.41/zang/five/fre.php
Loki Password Stealer (PWS) botnet C2 (confidence level: 75%)
urlhttps://seekwiggleuz.shop/api
Lumma Stealer botnet C2 (confidence level: 75%)
urlhttp://284386cm.renyash.ru/secureprocesslocal.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://mak1nt0sh.ru/providervideolinepollserverdefaultgenerator.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://burjuip7.beget.tech/999d36aa.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://185.177.239.237/2/process/basetemporary/76js/poll3external6/2/process3/async/4/wpprocesslow/sqllowvoiddbpython/8downloads/6downloads2/tophphttp/line_protectwppubliccdn.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://124.221.5.207:1444/eytk
Cobalt Strike botnet C2 (confidence level: 75%)
urlhttps://scodt.sbs/
Vidar botnet C2 (confidence level: 100%)
urlhttps://95.216.181.179/
Vidar botnet C2 (confidence level: 100%)
urlhttps://saytunka.com/3e2w.js
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://saytunka.com/js.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttp://feheecfmkmhfiij.top/1.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://angerinfecute.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://regetgoos.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://longingfluffyr.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://aquaticteachu.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://foreigoiru.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://lyingcollage.cyou/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://yokeseddat.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://whitebeauti.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://winnyhelplejsu.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://wordemnyauop.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://burnsubstract.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://infamouszeia.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://crowsudysto.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://94.156.177.41/zang/five/pvqdq929bsx_a_d_m1n_a.php
LokiBot botnet C2 (confidence level: 100%)
urlhttp://abemoussa.com/forum/viewtopic.php
Pony botnet C2 (confidence level: 100%)
urlhttps://impresnyb.cyou/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://welltodobaoz.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://growthselec.bond/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://immolatechallen.bond/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://buynostopliik.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://strivehelpeu.bond/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://chairsrainys.click/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://crookedfoshe.bond/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://abruptupricez.click/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://minebradjr.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://boilyroose.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://utterrelat.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://factlosserk.click/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://edcatiofireeu.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://tinpanckakgou.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://veilyspen.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://reviewofficed.click/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://necessaryattm.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://tranquiltoughz.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://uqitslooep.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://burnressert.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttp://147.45.41.134/b65e93b2e3fe9102/vcruntime140.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttps://91.107.224.54/4184da83d7329318/sqlite3.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttp://91.214.78.178/094d58d3b8547ded/vcruntime140.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttp://91.211.248.13/7e94ecaaae676f92/sqlite3.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttp://5.42.66.25/287dbd4538093b9e/sqlite3.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttp://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttp://185.196.10.147/4cadf15814a54569/vcruntime140.dll
Stealc payload delivery URL (confidence level: 50%)
urlhttps://94.156.177.41/zang/five/pvqdq929bsx_a_d_m1n_a.php
Loki Password Stealer (PWS) botnet C2 (confidence level: 50%)
urlhttps://94.156.177.41/alpha/five/pvqdq929bsx_a_d_m1n_a.php
Loki Password Stealer (PWS) botnet C2 (confidence level: 50%)
urlhttp://1800callabe.com/ponyb/gate.php
Pony botnet C2 (confidence level: 50%)
urlhttp://1866callabe.com/ponyb/gate.php
Pony botnet C2 (confidence level: 50%)
urlhttp://abemoussa.com/ponyb/gate.php
Pony botnet C2 (confidence level: 50%)
urlhttp://abstain.org.uk/2nkrox.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://bebecaracas.com/rxu4wzo.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://keralahouseboatstourpackages.com/fxx.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://ranchoencantado.la/ekucjs.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://shockalocka.com/x8t41au.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://thehomesaversdirect.com/9n9j6mx.exe
Pony payload delivery URL (confidence level: 50%)
urlhttp://www.arrow2000.ca/riqw07xs.exe
Pony payload delivery URL (confidence level: 50%)
urlhttps://kuishang.top/work/original.js
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://kuishang.top/work/index.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://kuishang.top/work/help.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://mffaccessories.com/files.zip
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://twigbestug.shop/api
Lumma Stealer botnet C2 (confidence level: 75%)
urlhttp://low0hit.com/front.php
Satacom botnet C2 (confidence level: 100%)
urlhttps://comptetscant.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)

Domain

ValueDescriptionCopy
domainagamwizard.duckdns.org
Remcos botnet C2 domain (confidence level: 100%)
domain0sbs.sbs
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainapi.seamrrobots.ddns-ip.net
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainat1.227api.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainat2.227api.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainat3.227api.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincdn.looklook.sbs
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainfingerswinger.net
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainjhg.australiasoutheast.cloudapp.azure.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns1.falsh.cc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns4.toptencent.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainscan.daztar.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainsosgo.top
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainwww.baidu-image.top
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainelasticchees.help
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaincratevexxer.icu
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainlyricalamuuso.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainscodt.sbs
Vidar botnet C2 domain (confidence level: 100%)
domaincrookedfoshe.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainfcan.kliphigafue.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaingrowthselec.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainimmolatechallen.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainjarry-deatile.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainjarry-fixxer.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainpain-temper.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainsteelysacckz.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainstripedre-lot.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainstrivehelpeu.bond
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaintwelveff20pn.top
CryptBot botnet C2 domain (confidence level: 100%)
domaina1075044.xsph.ru
DCRat botnet C2 domain (confidence level: 100%)
domainf1069418.xsph.ru
DCRat botnet C2 domain (confidence level: 100%)
domaincrowsudysto.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaininfamouszeia.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainwordemnyauop.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainburnsubstract.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainwinnyhelplejsu.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainyokeseddat.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainwhitebeauti.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainlyingcollage.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainaquaticteachu.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainforeigoiru.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainlongingfluffyr.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainregetgoos.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainangerinfecute.cyou
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainniness9sr.top
CryptBot botnet C2 domain (confidence level: 100%)
domainfortyuu14th.top
CryptBot botnet C2 domain (confidence level: 100%)
domainfeheecfmkmhfiij.top
MintsLoader payload delivery domain (confidence level: 75%)
domaindiebinjmajbkhhg.top
MintsLoader payload delivery domain (confidence level: 75%)
domainlggknhaffleahbh.top
MintsLoader payload delivery domain (confidence level: 75%)
domainveadytgffttw.top
MintsLoader payload delivery domain (confidence level: 75%)
domainjjdgdeffjimfgne.top
MintsLoader payload delivery domain (confidence level: 100%)
domainkcehmenjdibnmni.top
MintsLoader payload delivery domain (confidence level: 100%)
domaingajaechkfhfghal.top
MintsLoader payload delivery domain (confidence level: 100%)
domainrosettahome.cn
Stealc botnet C2 domain (confidence level: 100%)
domainedealselite.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainywsfalsysy.duckdns.org
AsyncRAT botnet C2 domain (confidence level: 50%)
domainsizefixeds.icu
Lumma Stealer botnet C2 domain (confidence level: 50%)
domainboetz.duckdns.org
Mirai botnet C2 domain (confidence level: 50%)
domaincomponents-stages.gl.at.ply.gg
NjRAT botnet C2 domain (confidence level: 50%)
domainrepublicadominica2025.ip-ddns.com
Remcos botnet C2 domain (confidence level: 50%)
domainmidhkalfmddcece.top
FAKEUPDATES payload delivery domain (confidence level: 75%)
domainreporting.mllcrosoft.com
Havoc botnet C2 domain (confidence level: 100%)
domainelevenuu11th.top
CryptBot botnet C2 domain (confidence level: 100%)
domaineur-agriculture.gl.at.ply.gg
XWorm botnet C2 domain (confidence level: 100%)
domaininterior-gov-pk.mail-govt.org
SideWinder botnet C2 domain (confidence level: 75%)
domaindiligent-health.org
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainolxpaymetod.sbs
Lumma Stealer payload delivery domain (confidence level: 100%)
domaindpmg.club
Lumma Stealer payload delivery domain (confidence level: 100%)
domainpropierty-hotelid424497.com
Lumma Stealer payload delivery domain (confidence level: 100%)
domainecliptera.info
DONOT botnet C2 domain (confidence level: 100%)
domainenchantebelle.buzz
DONOT botnet C2 domain (confidence level: 100%)
domainupdash.info
DONOT botnet C2 domain (confidence level: 100%)
domainwanderwave.buzz
DONOT botnet C2 domain (confidence level: 100%)
domainleckfeel.info
DONOT botnet C2 domain (confidence level: 100%)
domainmssttt.ailicte.com
DONOT botnet C2 domain (confidence level: 100%)
domainfiffyservices.info
DONOT botnet C2 domain (confidence level: 100%)
domainroofcap.info
DONOT botnet C2 domain (confidence level: 100%)
domainservericescap.info
DONOT botnet C2 domain (confidence level: 100%)
domaincrewcleaner.info
DONOT botnet C2 domain (confidence level: 100%)
domaintoolgpt.buzz
DONOT botnet C2 domain (confidence level: 100%)
domainkuishang.top
FAKEUPDATES payload delivery domain (confidence level: 100%)
domainjamuro-52920.portmap.io
DCRat botnet C2 domain (confidence level: 50%)
domaincomina998.ddns-ip.net
Remcos botnet C2 domain (confidence level: 50%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainmgubu48bnxi43.top
FAKEUPDATES botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns1.dursomo.com
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainsomehost.p0c.xyz
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaintemp3.tests.red
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainonllne-cltadelle-lv.abyssalempress.com
AsyncRAT botnet C2 domain (confidence level: 100%)
domaintransfermone.dynuddns.com
AsyncRAT botnet C2 domain (confidence level: 100%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincf.r8.lc
Cobalt Strike botnet C2 domain (confidence level: 75%)

Threat ID: 682c7dc2e8347ec82d2ddb14

Added to database: 5/20/2025, 1:04:02 PM

Last enriched: 6/19/2025, 4:17:50 PM

Last updated: 8/17/2025, 11:15:33 PM

Views: 21

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

External Links

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats