ThreatFox IOCs for 2025-03-04
Severity: mediumType: malware
ThreatFox IOCs for 2025-03-04
AI Analysis
Technical Summary
The provided threat information pertains to a malware-related report titled "ThreatFox IOCs for 2025-03-04," sourced from ThreatFox, which is a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The threat is categorized under "type:osint," indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. No specific affected product versions or software are identified, and there are no associated Common Weakness Enumerations (CWEs) or patch links, suggesting that this report is more of a general intelligence update rather than a detailed vulnerability disclosure. The technical details include a threat level of 2 (on an unspecified scale), an analysis score of 1, and a distribution score of 3, which may imply moderate dissemination or relevance. There are no known exploits in the wild, and no indicators of compromise (IOCs) are provided within this dataset. The absence of detailed technical indicators or affected systems limits the ability to pinpoint exact attack vectors or malware behavior. Overall, this appears to be an informational update on malware-related IOCs collected or observed as of March 4, 2025, without direct evidence of active exploitation or targeted vulnerabilities.
Potential Impact
Given the lack of specific affected products, versions, or detailed technical indicators, the direct impact on European organizations is currently limited. However, as this intelligence pertains to malware-related IOCs, it suggests potential reconnaissance or preparatory activities that could precede targeted attacks. European organizations relying on open-source intelligence feeds or threat intelligence platforms like ThreatFox may benefit from early awareness but should remain vigilant. The medium severity rating indicates a moderate risk level, implying that while immediate exploitation is not evident, the threat could evolve or be leveraged in future campaigns. Potential impacts include unauthorized access, data exfiltration, or disruption if the malware is deployed effectively. The absence of known exploits in the wild reduces immediate risk, but organizations should consider this as a signal to review their detection capabilities and incident response readiness. Critical sectors such as finance, government, and infrastructure in Europe could be indirectly affected if threat actors use these IOCs to craft targeted attacks.
Mitigation Recommendations
1. Integrate Threat Intelligence Feeds: European organizations should incorporate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) systems to enhance detection capabilities for emerging IOCs. 2. Enhance Endpoint Detection and Response (EDR): Deploy and regularly update EDR solutions capable of identifying anomalous behaviors associated with malware, even in the absence of specific signatures. 3. Conduct Regular Threat Hunting: Use the intelligence from this report as a baseline to proactively search for suspicious activities within networks. 4. Employee Awareness and Training: Since no user interaction details are provided, maintaining general cybersecurity hygiene and phishing awareness remains critical. 5. Network Segmentation and Least Privilege: Limit lateral movement potential by segmenting networks and enforcing strict access controls. 6. Incident Response Preparedness: Update and test incident response plans to ensure readiness for potential malware incidents that may arise from evolving threats indicated by these IOCs. 7. Monitor for Updates: Continuously monitor ThreatFox and other intelligence sources for updates or additional indicators related to this threat to adapt defenses accordingly.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland
Indicators of Compromise
- url: https://main.goarbits.de/gmmkz4rjculle1q8kobaumocqvsljoq9nto62wbgrnbrhapvtsoe1drch0dtzaywfdx3uupokz2xi6aynmxqyp7fe8yv5i953videx4biht0sgzhjcnwjlfp/verify
- domain: 6128385340.sbs
- url: https://gensyisgroup.com/ihiuq7avb6gmappgtnkoaowfd7hbakkhryv7c25rzbl4bwmyb3xywx0ceutzchffktwjfoi6xf0fd9xxdxo6wmzqnjwuqewnpgooijo4lld99nodigdkdcrnhtz7ikfnbth3haaek7rrfohhkbyob7/index
- domain: check.xajax.icu
- domain: unitedcredible.com
- domain: curly-scene-201f.kyliejenner0921.workers.dev
- url: https://yugaljeeautomotive.com/coi/jm3cgeoe9yahsvtblx5mmkcsqasv8zeuujrkmmel89xowup7dcqdz16owu5co4qzybrm4n4jfbul5gkha37yibxj1nvktkjcgho2vb0zn2zynfidwefkq60ghrostysxupxdan8fyrovhnaq2pca7tvf6el9qopw1stfidldot/verify
- url: https://docu839849948sos.padstowpridez.com/5pq7ngjyc1mw6zciekqc7ruoonuxrfezahtmdgrz4llopysqvhzpljhhbyonbs9wn9ea2i033gjfxm88jyvrbfsakoxtdtwsveqakdo2gcixfw4tpd16kum5/verify
- url: https://flexsjets.com/c4x6wo7ucqxwnsyymkcwkrej96gufvv2m2mug7jqffhtajteb0sz0haxqcwaiwkyripurbtu6sygovpngjnl1tudpxgaiavxkoffxhyekq54874qome0nodgr859zctsazk8s1ptbowibrsd3zdl3bo5v9l2/verify
- domain: pencilfight.click
- file: 43.153.2.113
- hash: 443
- url: https://twilightkokocodream.xyz/mzexmzm0ytq2zgrk/
- url: https://bobofosolsticepeak.xyz/ode4ytdiymy1ytdl/
- domain: prodatos.com
- domain: synaptic.co.tz
- url: https://dvw2oc4fr9ulz.cloudfront.net/gfac4ybcxpyb7gyj8gotvnkvawsdzhrno6bmwmnwxaqxrtl2fepl1h82vgj4yisoquqxwma6brxtyuzjhqpraodwttc57mwhd0ptdpj1o5mkfbfs1gou0dlkr3j3bvznomx8ik4dsueul03ee2czvf/verify
- url: https://www.beyondei.com/1/wan5q16t3onhxa2rletgf8ipk5mfo3l7l546nugwbprfaq6ogozlybhvbshmykb0sxzd8xq2uw0zqvrubkje1dif9cnc3sq9zxwjevviahavqmjykr7roh8y94atomndjtxgdpghflxsspdbuutzef/verify
- url: https://downloadingsoft.top/zo1ox6e1cuk6039hwpiatcdfgq7tugn22jolcdb9mmoqmrvanr7slclhnyyihaffomzmkk8l8xwcahb3qjvldso43ovzkoapp2yrrxwbpuqwdm0wvxbwqrpsgrtuetzyvbs7iug1qj/index?a=yw5kcmv3lnbvd2vsbebvy2zslm5lda==
- url: https://yugaljeeautomotive.com/coi/ws4x62cmqxmsokctogn9zbbbfqb4pac7msi2vp17tvd91yyz0yt4o6o8ra2le1hejouadsz3mlmjpurn9w5eqftcihxl5iaj7h6ffbdup8yulwfasentni8ghknmdvlqwezdcpto0ivowzbov3xhcoseklwyhkfxa3r5jz/verify
- url: https://gocoloflarecrest.xyz/mzvlmgq1zjgxztc5/
- file: 31.223.7.121
- hash: 1604
- url: https://cobokostarfall.xyz/mtlhoddkotm2ndbk/
- file: 47.108.136.66
- hash: 8888
- file: 193.26.115.188
- hash: 7077
- file: 172.81.133.115
- hash: 8808
- file: 157.90.192.89
- hash: 15748
- file: 109.120.137.254
- hash: 80
- domain: webmail.welbngusnews.xyz
- domain: cpcontacts.bestofufabetgames.xyz
- domain: cpanel.toptenufabetgames.xyz
- domain: cpcontacts.touchufabetgames.xyz
- domain: webdisk.upnddownapps.xyz
- domain: cpcontacts.dmhubnewsz.website
- domain: webdisk.takeufagame1212.xyz
- domain: cpcontacts.homeimprovementbox.website
- domain: cpcalendars.textagenai.xyz
- domain: webdisk.totogames1network.xyz
- domain: cpanel.livebengsnnewz.xyz
- domain: cpcontacts.proonlinehub.xyz
- domain: webdisk.top5business.website
- domain: webdisk.bookslinedzmod.xyz
- domain: webdisk.livebengsnnewz.xyz
- domain: cpcalendars.gamesofalltotobest.xyz
- domain: webdisk.generalztipsal.xyz
- domain: cpcontacts.topfiveufabetgames.xyz
- file: 46.246.14.13
- hash: 9090
- file: 54.189.72.119
- hash: 37213
- file: 34.201.34.158
- hash: 9142
- file: 194.9.6.104
- hash: 1337
- url: https://play265578236532778823998298387378.neone2.com/?cf-turnstile-response=0.j6xmzcutlaqb15vwbvubfehcno7zqyvb9-7j_tnnkt5xzz6kav56gsaeb6awuttid1fysvjbyolkx_btyavln1gvhberfi2oohqz9wpqh2fgjr0jh9joy8cq0zodxcbszdk2dryymowdohcy8btn99x8a1iqkqkv4y9tvnfmfy99u30pmc0ew0v8aa4dquejlsbzsccd8lacjalmkmcvy8rfnlyf5vgf8mvsxxrhigwtxkeum-1bimianntxme8jap4gzc-ddkljodyawabqfxl6p2jh7vwycmktlr5txcal2i4ur5te3vmcaozgx5pdbpas0mymaloux21ikemvocn4mhueb-7szljulyuxoo_vnny08wpok4fpzug6xbedqwd0p_qxycxhqibbikw0dpuw3lifqmyjyhfsbfkiy7jb3a15y-31eg1pbwmta2kecaazkpus4kzp6hbvdsbxown47lnguwvrzrjorx_z1ywgifoeqnif3gw0pvbgbprezjc8an-vmisfhtixblzahpat_jta57mxs9vz0hfbaahfmrifwx8ieppst4jwe_xe_ry8t-3s72sbrwvn2ifbxwv9em_z5bmzmzm8jswkex0-ui41sqvorg7fw6q33uup90jfzp8eiblvkkhpicpihkqknw4dtqnmwpemlwrjrb9-laqckpucn5k1cnbyuqqu4xrk_g4phxvapzsz3c8qrlvwmpt34nbjzbyuqunkneepn-3n7ypthcgbqipzhmx-5ukjoinusxvd_l8eacdmdm4hfhw7eoighnpcxrkrpqgjspmo4ee5wwctwiu3ni39h6a4mdslgpz6hwzcuup0febycykd0onlh1v1eqqt7ttulabrwlfbtef33bmfbam1.-e66m7o92c-gbgtpmhyiug.2c6d6a38815277543b32df5dd
- file: 164.92.163.239
- hash: 3898
- url: http://a1088739.xsph.ru/9f1b8aa0.php
- url: https://yugaljeeautomotive.com/coi/qa33r45wkhlnklrdlb0th9jtnov0vwmt25bf2phtgqbse7pdxigxpcyoodsvjway9zoyvjivb89cabfuchsd1hscu0oo6bmg8zokcjgaxgnmhrqx2i4m4fqdo8eijwxlzzewnyj6kfa7ydrilmsinuvt7/verify
- url: http://a1090709.xsph.ru/f1bbaf6b.php
- url: http://avensrp.fvds.ru/servertrackdump/js/js/4downloadsgamegame/downloadsgeneratorprovider/async/externaltotestwordpress.php
- file: 190.54.3.244
- hash: 80
- file: 121.41.108.106
- hash: 10000
- file: 195.177.94.100
- hash: 8080
- file: 74.50.120.106
- hash: 8808
- file: 128.90.108.196
- hash: 2000
- domain: webmail.bottomofbusiness.website
- domain: webdisk.cgibusiness.xyz
- domain: webdisk.homeremodel.website
- domain: ev.tresquno.live
- domain: cpanel.pointtotechiworld.xyz
- domain: cpcalendars.enjoyufabet.xyz
- domain: ph62003.yblds888.uk
- domain: webmail.gamesofart.com
- domain: webmail.offonnetwork.com
- file: 34.240.169.56
- hash: 19573
- url: http://87.120.84.108/videotowindowstesttrackdownloads.php
- domain: weareharrisons.sombrainfinita.eu
- file: 107.21.247.186
- hash: 443
- domain: 173-255-204-48.ip.linodeusercontent.com
- file: 69.55.60.146
- hash: 7443
- domain: cpcontacts.gamesoffashion.com
- file: 165.73.252.176
- hash: 9999
- file: 196.251.81.133
- hash: 80
- file: 92.36.136.186
- hash: 8080
- file: 38.242.234.66
- hash: 8333
- file: 3.144.12.24
- hash: 3333
- file: 3.215.21.156
- hash: 443
- file: 54.226.108.33
- hash: 443
- file: 152.203.31.42
- hash: 8080
- file: 143.198.189.73
- hash: 3333
- file: 46.202.128.25
- hash: 3333
- file: 160.238.36.55
- hash: 3333
- file: 13.50.128.25
- hash: 3333
- file: 104.168.148.75
- hash: 3333
- file: 159.89.180.104
- hash: 3333
- file: 203.77.238.109
- hash: 443
- file: 52.63.25.206
- hash: 443
- file: 210.89.47.42
- hash: 443
- domain: 6881984750.sbs
- file: 195.200.19.58
- hash: 31337
- file: 134.209.63.21
- hash: 31337
- file: 121.36.23.206
- hash: 5555
- url: https://twitch.cx/0.8803459111604326
- url: https://rumble.tube/0.7405741784420097
- url: https://twitch.co.com/0.24406682467597451
- url: http://109.120.137.254/
- url: http://s10aklc3.beget.tech/index.php
- url: https://pastebin.com/raw/hqeh9clb
- domain: herald12x-35830.portmap.host
- file: 193.161.193.99
- hash: 35830
- domain: publication.garyjobeferguson.com
- domain: democratoze.space
- domain: reslinsights.shop
- domain: srolangvan.com
- file: 107.178.107.141
- hash: 80
- file: 38.55.129.84
- hash: 443
- file: 47.86.52.150
- hash: 80
- file: 123.60.61.181
- hash: 8888
- file: 18.166.214.96
- hash: 443
- file: 51.195.193.143
- hash: 443
- file: 31.57.166.58
- hash: 443
- file: 172.111.232.229
- hash: 8201
- file: 172.94.53.74
- hash: 8080
- file: 160.30.19.247
- hash: 8888
- file: 196.251.85.237
- hash: 7707
- file: 57.128.134.229
- hash: 6606
- file: 13.213.182.135
- hash: 80
- file: 166.88.225.113
- hash: 15443
- domain: webmail.toto7vgames.com
- domain: cpcalendars.thebestofbests.com
- domain: cpanel.newzwireread.com
- domain: muffins.chat
- domain: pastelab.xyz
- domain: d.mx.goldenloafuae.com
- url: https://d.mx.goldenloafuae.com/
- file: 121.199.75.77
- hash: 9999
- file: 113.44.92.25
- hash: 2095
- file: 47.108.172.28
- hash: 7777
- url: https://socialsscesforum.icu/api
- url: http://k1d5.icu/tp341/index.php
- url: http://porsikgq.beget.tech/l1nc0in.php
- file: 103.79.186.245
- hash: 443
- file: 146.70.87.138
- hash: 443
- file: 146.70.87.138
- hash: 80
- file: 2.91.184.1
- hash: 995
- file: 23.184.48.240
- hash: 443
- file: 38.132.122.161
- hash: 8888
- file: 46.101.140.228
- hash: 443
- file: 62.72.36.127
- hash: 443
- domain: check.mevif.icu
- url: https://check.mevif.icu/gkcxv.google
- url: https://horsesscissors.icu/art.php
- url: https://gloweceeralk.online/api
- url: https://aqppgenius.life/api
- url: http://161.248.87.241:8888/supershell/login/
- domain: piaktrip.online
- domain: intellisense.live
- file: 178.250.188.144
- hash: 22635
- file: 95.217.27.252
- hash: 443
- domain: tripplebanks.duckdns.org
- file: 206.123.152.99
- hash: 3399
- file: 144.202.85.30
- hash: 80
- domain: check.qukex.icu
- url: https://check.qukex.icu/gkcxv.google
- domain: check.celir.icu
- url: https://check.celir.icu/gkcxv.google
- file: 205.185.115.242
- hash: 54321
- file: 117.72.41.61
- hash: 4000
- file: 117.72.47.60
- hash: 8088
- file: 101.37.116.219
- hash: 80
- file: 101.37.116.219
- hash: 443
- file: 156.238.233.109
- hash: 443
- file: 154.40.44.195
- hash: 9876
- file: 172.93.218.189
- hash: 2404
- file: 194.15.216.113
- hash: 8080
- file: 18.162.191.208
- hash: 8888
- file: 23.94.207.135
- hash: 8808
- file: 107.178.103.149
- hash: 7707
- file: 107.178.103.149
- hash: 6606
- file: 195.58.58.58
- hash: 6606
- file: 195.58.58.58
- hash: 7707
- domain: cpcalendars.offonnetwork.com
- domain: cpanel.latestsportshub.com
- domain: cpcalendars.fashionof11.com
- file: 52.209.223.124
- hash: 40000
- file: 188.214.129.216
- hash: 80
- domain: 8143612848.sbs
- url: https://digitalflwr.com/captcha.php
- url: https://intellisense.live/gerda.php
- domain: digitalflwr.com
- domain: intellisense.live
- file: 47.239.165.225
- hash: 2053
- file: 147.185.221.26
- hash: 21909
- file: 128.254.146.183
- hash: 443
- url: http://178.17.170.209/overglass.php
- domain: check.pedaz.icu
- url: https://check.pedaz.icu/gkcxv.google
- url: https://miz2.dorklifedubbed.shop/bdc2be5bddda548dec3c2d88464a698627ac9447aae621d8.wks
- url: https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f
- file: 18.220.30.194
- hash: 8000
- file: 103.85.190.202
- hash: 6688
- url: https://harmarpets.com/4w8u.js
- domain: harmarpets.com
- url: https://harmarpets.com/js.php
- url: http://138.68.80.167/packetdefaultasynctrafficwordpresspublictempcdn.php
- domain: check.jojyq.icu
- url: https://check.jojyq.icu/gkcxv.google
- file: 45.61.141.226
- hash: 443
- url: https://pddinghenarkijui.shop/api
- domain: check.vijaw.icu
- url: https://check.vijaw.icu/gkcxv.google
- file: 142.202.242.173
- hash: 443
- url: https://filmlerzltyazilimsx.shop/work/original.js
- domain: filmlerzltyazilimsx.shop
- url: https://filmlerzltyazilimsx.shop/work/index.php
- url: https://filmlerzltyazilimsx.shop/work/fill.php
- url: https://thetileboutique.in/wiatrace.zip
- file: 5.181.159.60
- hash: 443
- domain: check.lybuk.icu
- url: https://check.lybuk.icu/gkcxv.google
- file: 20.189.112.107
- hash: 443
- file: 45.92.1.33
- hash: 2404
- file: 93.123.118.40
- hash: 2404
- file: 192.3.220.21
- hash: 2404
- file: 196.251.81.165
- hash: 8808
- file: 196.251.116.95
- hash: 555
- domain: cpcalendars.businesseshub.xyz
- domain: cpcontacts.magzineviralzhubz.xyz
- domain: webdisk.welbngusnews.xyz
- domain: cpanel.gamesoffashion45.xyz
- domain: cpcalendars.bestteamofufabetgames.xyz
- domain: check.nafeh.icu
- url: https://check.nafeh.icu/gkcxv.google
- domain: api.youtubedns.com
- file: 107.148.41.31
- hash: 53
- domain: check.darax.icu
- url: https://check.darax.icu/gkcxv.google
- url: https://forefilarem.com/test/
- domain: 6068815810.sbs
- domain: 1889908961.sbs
- domain: e.mx.goldenloafuae.com
- url: https://e.mx.goldenloafuae.com/
- url: https://check.lijam.icu/gkcxv.google
- file: 107.174.39.161
- hash: 6009
- file: 185.43.4.72
- hash: 8001
- file: 154.8.160.34
- hash: 8081
- file: 69.61.84.210
- hash: 2404
- file: 37.221.64.232
- hash: 20201
- file: 45.129.2.63
- hash: 8443
- file: 91.206.178.111
- hash: 8443
- file: 62.192.174.138
- hash: 443
- file: 161.35.40.73
- hash: 4443
- file: 136.243.111.71
- hash: 85
- file: 104.219.236.202
- hash: 8808
- file: 128.90.108.156
- hash: 9999
- file: 134.209.226.202
- hash: 443
- file: 20.229.219.117
- hash: 443
- file: 213.209.150.193
- hash: 8089
- domain: cpcontacts.homesemupo.xyz
- domain: cpcalendars.ashionof121.xyz
- domain: webdisk.bestreadup.xyz
- domain: cpcalendars.businesshostz.xyz
- domain: webmail.topbusineszworldk.xyz
- domain: cpanel.shakdmisab.xyz
- domain: webdisk.top5business.xyz
- domain: webmail.fortlivenewzshub.xyz
- domain: cpcalendars.fstnewmedia.xyz
- domain: cpcontacts.ufatopgames.website
- domain: cpanel.top5business.website
- domain: webdisk.toplvlnewz.xyz
- domain: webmail.ufabetgameslover89.xyz
- domain: cpcontacts.onlinegameshub.xyz
- domain: cpanel.policemt76.website
- domain: cpcalendars.modegenerlshub.xyz
- domain: cpcontacts.reprtgeneralshub.xyz
- file: 79.241.109.16
- hash: 82
- file: 213.209.150.220
- hash: 80
- url: https://check.qozab.icu/gkcxv.google
- url: https://check.bajys.icu/gkcxv.google
- file: 108.61.78.206
- hash: 60000
- file: 163.181.221.72
- hash: 4506
- file: 187.170.51.238
- hash: 995
- file: 45.129.2.63
- hash: 80
- file: 59.110.140.142
- hash: 3389
- file: 88.229.251.194
- hash: 443
- file: 103.79.120.70
- hash: 5000
- file: 103.79.120.70
- hash: 443
- file: 128.199.2.196
- hash: 4444
- url: http://91141ncm.darkproducts.ru/linelowlongpolltemp.php
- file: 185.43.4.73
- hash: 8001
- file: 43.165.133.147
- hash: 443
- file: 47.119.158.127
- hash: 9999
- file: 103.24.95.45
- hash: 8123
- file: 103.24.95.47
- hash: 8123
- file: 43.156.94.92
- hash: 31337
- file: 159.100.18.87
- hash: 31337
- file: 43.134.67.236
- hash: 31337
- file: 34.168.59.70
- hash: 3333
- file: 52.35.122.179
- hash: 443
- file: 54.210.76.140
- hash: 9067
- file: 44.202.91.195
- hash: 33060
- url: http://172.86.77.102/84ab9e91729b85a0/sqlite3.dll
- url: https://68.183.108.129/75959266227880b0/vcruntime140.dll
- url: http://45.15.157.211/6d44dd0da6f70e60/sqlite3.dll
- url: http://109.107.181.33/742d3278227bff91/vcruntime140.dll
- url: http://208.91.189.189/05b85f6a6b0e9444/vcruntime140.dll
- url: http://45.155.250.218/92bfcbf4e12ebf6e/vcruntime140.dll
- url: http://95.182.97.58/126d33f6b8f9bd61/vcruntime140.dll
- url: http://95.182.97.58/126d33f6b8f9bd61/mozglue.dll
- url: http://5.188.87.43/b77ca0c1f70b8d17/sqlite3.dll
- url: http://5.188.87.43/b77ca0c1f70b8d17/mozglue.dll
- url: http://5.188.87.43/b77ca0c1f70b8d17/vcruntime140.dll
- url: http://185.250.207.143/045a547eb12a29f7/mozglue.dll
- url: http://185.250.207.143/045a547eb12a29f7/sqlite3.dll
- url: http://185.250.207.143/045a547eb12a29f7/vcruntime140.dll
- url: http://45.88.105.102/38b8ec3c704e5850/sqlite3.dll
- url: http://45.88.105.102/38b8ec3c704e5850/mozglue.dll
- url: http://45.88.105.102/38b8ec3c704e5850/vcruntime140.dll
- url: http://45.91.202.84/61c2e0b4269a1b39/mozglue.dll
- url: http://45.91.202.84/61c2e0b4269a1b39/vcruntime140.dll
- url: http://45.91.202.84/61c2e0b4269a1b39/sqlite3.dll
- url: https://91.215.85.11/15f869479d73f92a/sqlite3.dll
- url: http://95.215.204.230/08944c4ccd05189a/sqlite3.dll
- url: http://95.215.204.230/08944c4ccd05189a/vcruntime140.dll
- url: http://95.215.204.230/08944c4ccd05189a/mozglue.dll
- url: http://154.216.20.22/txt/rfp1ykrwym1odxc.exe
- url: http://154.216.20.22/txt/sr01fduyuje6o2v.exe
- url: http://81.161.229.110/htdocs/ingmdybaekrstrt.exe
- url: http://37.139.129.142/htdocs/ephgsylqpfdwsqw.exe
- url: https://185.196.8.195/u6vhsc3ppq/index.php
- url: https://wordingvenuo.fun/api
- url: https://www.wingsaviationacademy-in.salviatech.com/
- url: https://twitch.cx/0.13154023818642013
- url: https://twitch.co.com/0.11398267272224927
- url: https://twitch.co.com/0.8821142654965011
- url: https://twitch.co.com/0.5438713417753174
- url: http://www.00ltsapp03.vip/hm26/
- url: http://www.07health.net/hm26/
- url: http://www.3436800poknvdrt43wd.xyz/hm26/
- url: http://www.5172.net/hm26/
- url: http://www.8013.net/hm26/
- url: http://www.albello.xyz/hm26/
- url: http://www.ale-fertility-cyprus.today/hm26/
- url: http://www.alista21.site/hm26/
- url: http://www.allrepair-br14.bond/hm26/
- url: http://www.andar919-ok.lol/hm26/
- url: http://www.anzeal.xyz/hm26/
- url: http://www.anzxjao.shop/hm26/
- url: http://www.ap.rent/hm26/
- url: http://www.aremmano-abruzzese.net/hm26/
- url: http://www.ascular.shop/hm26/
- url: http://www.cehaiou.net/hm26/
- url: http://www.ebbtw.shop/hm26/
- url: http://www.eki.tokyo/hm26/
- url: http://www.enjoy.store/hm26/
- url: http://www.ental-implants-trend.today/hm26/
- url: http://www.erafic.shop/hm26/
- url: http://www.erlincasinostars.net/hm26/
- url: http://www.ertsolana.site/hm26/
- url: http://www.evelupstudio.store/hm26/
- url: http://www.hoabforall.work/hm26/
- url: http://www.houzentei-soukan.work/hm26/
- url: http://www.iccana.store/hm26/
- url: http://www.inematography-course-95431.bond/hm26/
- url: http://www.ink21planetbola88.xyz/hm26/
- url: http://www.iquilfy.finance/hm26/
- url: http://www.iromimapearl.website/hm26/
- url: http://www.isefyxerlink.info/hm26/
- url: http://www.j091p63ng.vip/hm26/
- url: http://www.kmmm.fun/hm26/
- url: http://www.martev.world/hm26/
- url: http://www.npersbrec.pro/hm26/
- url: http://www.ome-repair-003.today/hm26/
- url: http://www.onstruktor.fit/hm26/
- url: http://www.oodwaste.biz/hm26/
- url: http://www.oofing-jobs-au11-dp.click/hm26/
- url: http://www.orcalphone.net/hm26/
- url: http://www.orovistogoeur.shop/hm26/
- url: http://www.oseblissflower.net/hm26/
- url: http://www.ottomlinesa.net/hm26/
- url: http://www.oungerlonger.online/hm26/
- url: http://www.ovexyazilim.xyz/hm26/
- url: http://www.pplyforverifiedrateupdate.xyz/hm26/
- url: http://www.pps-61461.bond/hm26/
- url: http://www.prite.bio/hm26/
- url: http://www.ragrantgarjden.top/hm26/
- url: http://www.riceflashpulseflow.xyz/hm26/
- url: http://www.ruediscipleshipwear.shop/hm26/
- url: http://www.scortistanbulnoble.xyz/hm26/
- url: http://www.takeserviceclaim.online/hm26/
- url: http://www.tellieuse.site/hm26/
- url: http://www.tqy.store/hm26/
- url: http://www.ustclogs.shop/hm26/
- url: http://www.uxemboutique.store/hm26/
- url: http://www.wertb.xyz/hm26/
- url: http://www.xpressbasic.store/hm26/
- url: http://www.xucg.sbs/hm26/
- url: http://www.yber-ninja.store/hm26/
- url: http://www.younoi100web.online/hm26/
- url: http://www.yperbox.fun/hm26/
- url: http://www.yvirginiegarnier.design/hm26/
- domain: www.00ltsapp03.vip
- domain: www.07health.net
- domain: www.3436800poknvdrt43wd.xyz
- domain: www.5172.net
- domain: www.8013.net
- domain: www.albello.xyz
- domain: www.ale-fertility-cyprus.today
- domain: www.alista21.site
- domain: www.allrepair-br14.bond
- domain: www.andar919-ok.lol
- domain: www.anzeal.xyz
- domain: www.anzxjao.shop
- domain: www.ap.rent
- domain: www.aremmano-abruzzese.net
- domain: www.ascular.shop
- domain: www.cehaiou.net
- domain: www.ebbtw.shop
- domain: www.eki.tokyo
- domain: www.enjoy.store
- domain: www.ental-implants-trend.today
- domain: www.erafic.shop
- domain: www.erlincasinostars.net
- domain: www.ertsolana.site
- domain: www.evelupstudio.store
- domain: www.hoabforall.work
- domain: www.houzentei-soukan.work
- domain: www.iccana.store
- domain: www.inematography-course-95431.bond
- domain: www.ink21planetbola88.xyz
- domain: www.iquilfy.finance
- domain: www.iromimapearl.website
- domain: www.isefyxerlink.info
- domain: www.j091p63ng.vip
- domain: www.kmmm.fun
- domain: www.martev.world
- domain: www.npersbrec.pro
- domain: www.ome-repair-003.today
- domain: www.onstruktor.fit
- domain: www.oodwaste.biz
- domain: www.oofing-jobs-au11-dp.click
- domain: www.orcalphone.net
- domain: www.orovistogoeur.shop
- domain: www.oseblissflower.net
- domain: www.ottomlinesa.net
- domain: www.oungerlonger.online
- domain: www.ovexyazilim.xyz
- domain: www.pplyforverifiedrateupdate.xyz
- domain: www.pps-61461.bond
- domain: www.prite.bio
- domain: www.ragrantgarjden.top
- domain: www.riceflashpulseflow.xyz
- domain: www.ruediscipleshipwear.shop
- domain: www.scortistanbulnoble.xyz
- domain: www.takeserviceclaim.online
- domain: www.tellieuse.site
- domain: www.tqy.store
- domain: www.ustclogs.shop
- domain: www.uxemboutique.store
- domain: www.wertb.xyz
- domain: www.xpressbasic.store
- domain: www.xucg.sbs
- domain: www.yber-ninja.store
- domain: www.younoi100web.online
- domain: www.yperbox.fun
- domain: www.yvirginiegarnier.design
- domain: bibusiowoifajowo-22225.portmap
- domain: learning-exceptional.gl.at.ply.gg
- domain: freebirdkissingonmylipswithnicefeelings.duckdns.org
- file: 188.127.224.20
- hash: 4578
- domain: africa-wins.gl.at.ply.gg
- domain: language-leading.gl.at.ply.gg
- domain: newsletter-effects.gl.at.ply.gg
- file: 147.185.221.26
- hash: 42069
- url: http://cm48994.tw1.ru/77610f3c.php
ThreatFox IOCs for 2025-03-04
Medium
Published: Tue Mar 04 2025 (03/04/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2025-03-04
AI-Powered Analysis
AILast updated: 06/19/2025, 15:34:46 UTC
Technical Analysis
The provided threat information pertains to a malware-related report titled "ThreatFox IOCs for 2025-03-04," sourced from ThreatFox, which is a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The threat is categorized under "type:osint," indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. No specific affected product versions or software are identified, and there are no associated Common Weakness Enumerations (CWEs) or patch links, suggesting that this report is more of a general intelligence update rather than a detailed vulnerability disclosure. The technical details include a threat level of 2 (on an unspecified scale), an analysis score of 1, and a distribution score of 3, which may imply moderate dissemination or relevance. There are no known exploits in the wild, and no indicators of compromise (IOCs) are provided within this dataset. The absence of detailed technical indicators or affected systems limits the ability to pinpoint exact attack vectors or malware behavior. Overall, this appears to be an informational update on malware-related IOCs collected or observed as of March 4, 2025, without direct evidence of active exploitation or targeted vulnerabilities.
Potential Impact
Given the lack of specific affected products, versions, or detailed technical indicators, the direct impact on European organizations is currently limited. However, as this intelligence pertains to malware-related IOCs, it suggests potential reconnaissance or preparatory activities that could precede targeted attacks. European organizations relying on open-source intelligence feeds or threat intelligence platforms like ThreatFox may benefit from early awareness but should remain vigilant. The medium severity rating indicates a moderate risk level, implying that while immediate exploitation is not evident, the threat could evolve or be leveraged in future campaigns. Potential impacts include unauthorized access, data exfiltration, or disruption if the malware is deployed effectively. The absence of known exploits in the wild reduces immediate risk, but organizations should consider this as a signal to review their detection capabilities and incident response readiness. Critical sectors such as finance, government, and infrastructure in Europe could be indirectly affected if threat actors use these IOCs to craft targeted attacks.
Mitigation Recommendations
1. Integrate Threat Intelligence Feeds: European organizations should incorporate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) systems to enhance detection capabilities for emerging IOCs. 2. Enhance Endpoint Detection and Response (EDR): Deploy and regularly update EDR solutions capable of identifying anomalous behaviors associated with malware, even in the absence of specific signatures. 3. Conduct Regular Threat Hunting: Use the intelligence from this report as a baseline to proactively search for suspicious activities within networks. 4. Employee Awareness and Training: Since no user interaction details are provided, maintaining general cybersecurity hygiene and phishing awareness remains critical. 5. Network Segmentation and Least Privilege: Limit lateral movement potential by segmenting networks and enforcing strict access controls. 6. Incident Response Preparedness: Update and test incident response plans to ensure readiness for potential malware incidents that may arise from evolving threats indicated by these IOCs. 7. Monitor for Updates: Continuously monitor ThreatFox and other intelligence sources for updates or additional indicators related to this threat to adapt defenses accordingly.
Affected Countries
Need more detailed analysis?Get Pro
Pro Feature
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- 79818ca9-79b2-4fbc-b6e1-a960ac7d15dd
- Original Timestamp
- 1741132987
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://main.goarbits.de/gmmkz4rjculle1q8kobaumocqvsljoq9nto62wbgrnbrhapvtsoe1drch0dtzaywfdx3uupokz2xi6aynmxqyp7fe8yv5i953videx4biht0sgzhjcnwjlfp/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://gensyisgroup.com/ihiuq7avb6gmappgtnkoaowfd7hbakkhryv7c25rzbl4bwmyb3xywx0ceutzchffktwjfoi6xf0fd9xxdxo6wmzqnjwuqewnpgooijo4lld99nodigdkdcrnhtz7ikfnbth3haaek7rrfohhkbyob7/index | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://yugaljeeautomotive.com/coi/jm3cgeoe9yahsvtblx5mmkcsqasv8zeuujrkmmel89xowup7dcqdz16owu5co4qzybrm4n4jfbul5gkha37yibxj1nvktkjcgho2vb0zn2zynfidwefkq60ghrostysxupxdan8fyrovhnaq2pca7tvf6el9qopw1stfidldot/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://docu839849948sos.padstowpridez.com/5pq7ngjyc1mw6zciekqc7ruoonuxrfezahtmdgrz4llopysqvhzpljhhbyonbs9wn9ea2i033gjfxm88jyvrbfsakoxtdtwsveqakdo2gcixfw4tpd16kum5/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://flexsjets.com/c4x6wo7ucqxwnsyymkcwkrej96gufvv2m2mug7jqffhtajteb0sz0haxqcwaiwkyripurbtu6sygovpngjnl1tudpxgaiavxkoffxhyekq54874qome0nodgr859zctsazk8s1ptbowibrsd3zdl3bo5v9l2/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://twilightkokocodream.xyz/mzexmzm0ytq2zgrk/ | Coper botnet C2 (confidence level: 100%) | |
urlhttps://bobofosolsticepeak.xyz/ode4ytdiymy1ytdl/ | Coper botnet C2 (confidence level: 100%) | |
urlhttps://dvw2oc4fr9ulz.cloudfront.net/gfac4ybcxpyb7gyj8gotvnkvawsdzhrno6bmwmnwxaqxrtl2fepl1h82vgj4yisoquqxwma6brxtyuzjhqpraodwttc57mwhd0ptdpj1o5mkfbfs1gou0dlkr3j3bvznomx8ik4dsueul03ee2czvf/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://www.beyondei.com/1/wan5q16t3onhxa2rletgf8ipk5mfo3l7l546nugwbprfaq6ogozlybhvbshmykb0sxzd8xq2uw0zqvrubkje1dif9cnc3sq9zxwjevviahavqmjykr7roh8y94atomndjtxgdpghflxsspdbuutzef/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://downloadingsoft.top/zo1ox6e1cuk6039hwpiatcdfgq7tugn22jolcdb9mmoqmrvanr7slclhnyyihaffomzmkk8l8xwcahb3qjvldso43ovzkoapp2yrrxwbpuqwdm0wvxbwqrpsgrtuetzyvbs7iug1qj/index?a=yw5kcmv3lnbvd2vsbebvy2zslm5lda== | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://yugaljeeautomotive.com/coi/ws4x62cmqxmsokctogn9zbbbfqb4pac7msi2vp17tvd91yyz0yt4o6o8ra2le1hejouadsz3mlmjpurn9w5eqftcihxl5iaj7h6ffbdup8yulwfasentni8ghknmdvlqwezdcpto0ivowzbov3xhcoseklwyhkfxa3r5jz/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttps://gocoloflarecrest.xyz/mzvlmgq1zjgxztc5/ | Coper botnet C2 (confidence level: 100%) | |
urlhttps://cobokostarfall.xyz/mtlhoddkotm2ndbk/ | Coper botnet C2 (confidence level: 100%) | |
urlhttps://play265578236532778823998298387378.neone2.com/?cf-turnstile-response=0.j6xmzcutlaqb15vwbvubfehcno7zqyvb9-7j_tnnkt5xzz6kav56gsaeb6awuttid1fysvjbyolkx_btyavln1gvhberfi2oohqz9wpqh2fgjr0jh9joy8cq0zodxcbszdk2dryymowdohcy8btn99x8a1iqkqkv4y9tvnfmfy99u30pmc0ew0v8aa4dquejlsbzsccd8lacjalmkmcvy8rfnlyf5vgf8mvsxxrhigwtxkeum-1bimianntxme8jap4gzc-ddkljodyawabqfxl6p2jh7vwycmktlr5txcal2i4ur5te3vmcaozgx5pdbpas0mymaloux21ikemvocn4mhueb-7szljulyuxoo_vnny08wpok4fpzug6xbedqwd0p_qxycxhqibbikw0dpuw3lifqmyjyhfsbfkiy7jb3a15y-31eg1pbwmta2kecaazkpus4kzp6hbvdsbxown47lnguwvrzrjorx_z1ywgifoeqnif3gw0pvbgbprezjc8an-vmisfhtixblzahpat_jta57mxs9vz0hfbaahfmrifwx8ieppst4jwe_xe_ry8t-3s72sbrwvn2ifbxwv9em_z5bmzmzm8jswkex0-ui41sqvorg7fw6q33uup90jfzp8eiblvkkhpicpihkqknw4dtqnmwpemlwrjrb9-laqckpucn5k1cnbyuqqu4xrk_g4phxvapzsz3c8qrlvwmpt34nbjzbyuqunkneepn-3n7ypthcgbqipzhmx-5ukjoinusxvd_l8eacdmdm4hfhw7eoighnpcxrkrpqgjspmo4ee5wwctwiu3ni39h6a4mdslgpz6hwzcuup0febycykd0onlh1v1eqqt7ttulabrwlfbtef33bmfbam1.-e66m7o92c-gbgtpmhyiug.2c6d6a38815277543b32df5dd | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttp://a1088739.xsph.ru/9f1b8aa0.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://yugaljeeautomotive.com/coi/qa33r45wkhlnklrdlb0th9jtnov0vwmt25bf2phtgqbse7pdxigxpcyoodsvjway9zoyvjivb89cabfuchsd1hscu0oo6bmg8zokcjgaxgnmhrqx2i4m4fqdo8eijwxlzzewnyj6kfa7ydrilmsinuvt7/verify | Unknown malware botnet C2 (confidence level: 95%) | |
urlhttp://a1090709.xsph.ru/f1bbaf6b.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttp://avensrp.fvds.ru/servertrackdump/js/js/4downloadsgamegame/downloadsgeneratorprovider/async/externaltotestwordpress.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttp://87.120.84.108/videotowindowstesttrackdownloads.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://twitch.cx/0.8803459111604326 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://rumble.tube/0.7405741784420097 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.co.com/0.24406682467597451 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttp://109.120.137.254/ | Hook botnet C2 (confidence level: 50%) | |
urlhttp://s10aklc3.beget.tech/index.php | Azorult botnet C2 (confidence level: 50%) | |
urlhttps://pastebin.com/raw/hqeh9clb | XWorm botnet C2 (confidence level: 50%) | |
urlhttps://d.mx.goldenloafuae.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://socialsscesforum.icu/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttp://k1d5.icu/tp341/index.php | Azorult botnet C2 (confidence level: 100%) | |
urlhttp://porsikgq.beget.tech/l1nc0in.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://check.mevif.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://horsesscissors.icu/art.php | Unknown Loader botnet C2 (confidence level: 100%) | |
urlhttps://gloweceeralk.online/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://aqppgenius.life/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttp://161.248.87.241:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://check.qukex.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.celir.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://digitalflwr.com/captcha.php | Latrodectus payload delivery URL (confidence level: 100%) | |
urlhttps://intellisense.live/gerda.php | Latrodectus payload delivery URL (confidence level: 100%) | |
urlhttp://178.17.170.209/overglass.php | Koi Loader botnet C2 (confidence level: 100%) | |
urlhttps://check.pedaz.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://miz2.dorklifedubbed.shop/bdc2be5bddda548dec3c2d88464a698627ac9447aae621d8.wks | ClearFake payload delivery URL (confidence level: 75%) | |
urlhttps://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f | Rhadamanthys botnet C2 (confidence level: 100%) | |
urlhttps://harmarpets.com/4w8u.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://harmarpets.com/js.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttp://138.68.80.167/packetdefaultasynctrafficwordpresspublictempcdn.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://check.jojyq.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://pddinghenarkijui.shop/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://check.vijaw.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://filmlerzltyazilimsx.shop/work/original.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://filmlerzltyazilimsx.shop/work/index.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://filmlerzltyazilimsx.shop/work/fill.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://thetileboutique.in/wiatrace.zip | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://check.lybuk.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.nafeh.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.darax.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://forefilarem.com/test/ | Latrodectus botnet C2 (confidence level: 100%) | |
urlhttps://e.mx.goldenloafuae.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://check.lijam.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.qozab.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.bajys.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttp://91141ncm.darkproducts.ru/linelowlongpolltemp.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttp://172.86.77.102/84ab9e91729b85a0/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttps://68.183.108.129/75959266227880b0/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.15.157.211/6d44dd0da6f70e60/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://109.107.181.33/742d3278227bff91/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://208.91.189.189/05b85f6a6b0e9444/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.155.250.218/92bfcbf4e12ebf6e/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://95.182.97.58/126d33f6b8f9bd61/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://95.182.97.58/126d33f6b8f9bd61/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://5.188.87.43/b77ca0c1f70b8d17/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://5.188.87.43/b77ca0c1f70b8d17/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://5.188.87.43/b77ca0c1f70b8d17/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://185.250.207.143/045a547eb12a29f7/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://185.250.207.143/045a547eb12a29f7/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://185.250.207.143/045a547eb12a29f7/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.88.105.102/38b8ec3c704e5850/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.88.105.102/38b8ec3c704e5850/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.88.105.102/38b8ec3c704e5850/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.91.202.84/61c2e0b4269a1b39/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.91.202.84/61c2e0b4269a1b39/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://45.91.202.84/61c2e0b4269a1b39/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttps://91.215.85.11/15f869479d73f92a/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://95.215.204.230/08944c4ccd05189a/sqlite3.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://95.215.204.230/08944c4ccd05189a/vcruntime140.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://95.215.204.230/08944c4ccd05189a/mozglue.dll | Stealc payload delivery URL (confidence level: 50%) | |
urlhttp://154.216.20.22/txt/rfp1ykrwym1odxc.exe | MASS Logger payload delivery URL (confidence level: 50%) | |
urlhttp://154.216.20.22/txt/sr01fduyuje6o2v.exe | MASS Logger payload delivery URL (confidence level: 50%) | |
urlhttp://81.161.229.110/htdocs/ingmdybaekrstrt.exe | MASS Logger payload delivery URL (confidence level: 50%) | |
urlhttp://37.139.129.142/htdocs/ephgsylqpfdwsqw.exe | MASS Logger payload delivery URL (confidence level: 50%) | |
urlhttps://185.196.8.195/u6vhsc3ppq/index.php | Amadey botnet C2 (confidence level: 50%) | |
urlhttps://wordingvenuo.fun/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://www.wingsaviationacademy-in.salviatech.com/ | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.cx/0.13154023818642013 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.co.com/0.11398267272224927 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.co.com/0.8821142654965011 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.co.com/0.5438713417753174 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttp://www.00ltsapp03.vip/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.07health.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.3436800poknvdrt43wd.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.5172.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.8013.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.albello.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ale-fertility-cyprus.today/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.alista21.site/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.allrepair-br14.bond/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.andar919-ok.lol/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.anzeal.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.anzxjao.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ap.rent/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.aremmano-abruzzese.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ascular.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.cehaiou.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ebbtw.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.eki.tokyo/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.enjoy.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ental-implants-trend.today/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.erafic.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.erlincasinostars.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ertsolana.site/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.evelupstudio.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.hoabforall.work/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.houzentei-soukan.work/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.iccana.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.inematography-course-95431.bond/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ink21planetbola88.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.iquilfy.finance/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.iromimapearl.website/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.isefyxerlink.info/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.j091p63ng.vip/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.kmmm.fun/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.martev.world/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.npersbrec.pro/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ome-repair-003.today/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.onstruktor.fit/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.oodwaste.biz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.oofing-jobs-au11-dp.click/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.orcalphone.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.orovistogoeur.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.oseblissflower.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ottomlinesa.net/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.oungerlonger.online/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ovexyazilim.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.pplyforverifiedrateupdate.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.pps-61461.bond/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.prite.bio/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ragrantgarjden.top/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.riceflashpulseflow.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ruediscipleshipwear.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.scortistanbulnoble.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.takeserviceclaim.online/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.tellieuse.site/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.tqy.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.ustclogs.shop/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.uxemboutique.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.wertb.xyz/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.xpressbasic.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.xucg.sbs/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.yber-ninja.store/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.younoi100web.online/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.yperbox.fun/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://www.yvirginiegarnier.design/hm26/ | Formbook botnet C2 (confidence level: 50%) | |
urlhttp://cm48994.tw1.ru/77610f3c.php | DCRat botnet C2 (confidence level: 100%) |
Domain
| Value | Description | Copy |
|---|---|---|
domain6128385340.sbs | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaincheck.xajax.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainunitedcredible.com | ClearFake payload delivery domain (confidence level: 75%) | |
domaincurly-scene-201f.kyliejenner0921.workers.dev | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainpencilfight.click | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainprodatos.com | ClearFake payload delivery domain (confidence level: 75%) | |
domainsynaptic.co.tz | ClearFake payload delivery domain (confidence level: 75%) | |
domainwebmail.welbngusnews.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.bestofufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.toptenufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.touchufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.upnddownapps.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.dmhubnewsz.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.takeufagame1212.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.homeimprovementbox.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.textagenai.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.totogames1network.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.livebengsnnewz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.proonlinehub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.top5business.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.bookslinedzmod.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.livebengsnnewz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.gamesofalltotobest.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.generalztipsal.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.topfiveufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.bottomofbusiness.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.cgibusiness.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.homeremodel.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainev.tresquno.live | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.pointtotechiworld.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.enjoyufabet.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainph62003.yblds888.uk | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.gamesofart.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.offonnetwork.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainweareharrisons.sombrainfinita.eu | Unknown malware botnet C2 domain (confidence level: 100%) | |
domain173-255-204-48.ip.linodeusercontent.com | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.gamesoffashion.com | Havoc botnet C2 domain (confidence level: 100%) | |
domain6881984750.sbs | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainherald12x-35830.portmap.host | XWorm botnet C2 domain (confidence level: 50%) | |
domainpublication.garyjobeferguson.com | FAKEUPDATES payload delivery domain (confidence level: 50%) | |
domaindemocratoze.space | Lumma Stealer botnet C2 domain (confidence level: 50%) | |
domainreslinsights.shop | Lumma Stealer botnet C2 domain (confidence level: 50%) | |
domainsrolangvan.com | Mirai botnet C2 domain (confidence level: 75%) | |
domainwebmail.toto7vgames.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.thebestofbests.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.newzwireread.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainmuffins.chat | Mirai botnet C2 domain (confidence level: 100%) | |
domainpastelab.xyz | Mirai botnet C2 domain (confidence level: 100%) | |
domaind.mx.goldenloafuae.com | Vidar botnet C2 domain (confidence level: 100%) | |
domaincheck.mevif.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainpiaktrip.online | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainintellisense.live | Latrodectus botnet C2 domain (confidence level: 100%) | |
domaintripplebanks.duckdns.org | XWorm botnet C2 domain (confidence level: 100%) | |
domaincheck.qukex.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.celir.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpcalendars.offonnetwork.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.latestsportshub.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.fashionof11.com | Havoc botnet C2 domain (confidence level: 100%) | |
domain8143612848.sbs | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaindigitalflwr.com | Latrodectus payload delivery domain (confidence level: 100%) | |
domainintellisense.live | Latrodectus payload delivery domain (confidence level: 100%) | |
domaincheck.pedaz.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainharmarpets.com | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domaincheck.jojyq.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.vijaw.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainfilmlerzltyazilimsx.shop | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domaincheck.lybuk.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpcalendars.businesseshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.magzineviralzhubz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.welbngusnews.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.gamesoffashion45.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.bestteamofufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincheck.nafeh.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainapi.youtubedns.com | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domaincheck.darax.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domain6068815810.sbs | Unknown malware botnet C2 domain (confidence level: 100%) | |
domain1889908961.sbs | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaine.mx.goldenloafuae.com | Vidar botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.homesemupo.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.ashionof121.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.bestreadup.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.businesshostz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.topbusineszworldk.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.shakdmisab.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.top5business.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.fortlivenewzshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.fstnewmedia.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.ufatopgames.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.top5business.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.toplvlnewz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.ufabetgameslover89.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.onlinegameshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.policemt76.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.modegenerlshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.reprtgeneralshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwww.00ltsapp03.vip | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.07health.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.3436800poknvdrt43wd.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.5172.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.8013.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.albello.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ale-fertility-cyprus.today | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.alista21.site | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.allrepair-br14.bond | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.andar919-ok.lol | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.anzeal.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.anzxjao.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ap.rent | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.aremmano-abruzzese.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ascular.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.cehaiou.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ebbtw.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.eki.tokyo | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.enjoy.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ental-implants-trend.today | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.erafic.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.erlincasinostars.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ertsolana.site | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.evelupstudio.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.hoabforall.work | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.houzentei-soukan.work | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.iccana.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.inematography-course-95431.bond | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ink21planetbola88.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.iquilfy.finance | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.iromimapearl.website | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.isefyxerlink.info | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.j091p63ng.vip | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.kmmm.fun | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.martev.world | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.npersbrec.pro | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ome-repair-003.today | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.onstruktor.fit | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.oodwaste.biz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.oofing-jobs-au11-dp.click | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.orcalphone.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.orovistogoeur.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.oseblissflower.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ottomlinesa.net | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.oungerlonger.online | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ovexyazilim.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.pplyforverifiedrateupdate.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.pps-61461.bond | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.prite.bio | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ragrantgarjden.top | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.riceflashpulseflow.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ruediscipleshipwear.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.scortistanbulnoble.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.takeserviceclaim.online | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.tellieuse.site | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.tqy.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.ustclogs.shop | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.uxemboutique.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.wertb.xyz | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.xpressbasic.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.xucg.sbs | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.yber-ninja.store | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.younoi100web.online | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.yperbox.fun | Formbook botnet C2 domain (confidence level: 50%) | |
domainwww.yvirginiegarnier.design | Formbook botnet C2 domain (confidence level: 50%) | |
domainbibusiowoifajowo-22225.portmap | Quasar RAT botnet C2 domain (confidence level: 50%) | |
domainlearning-exceptional.gl.at.ply.gg | Quasar RAT botnet C2 domain (confidence level: 50%) | |
domainfreebirdkissingonmylipswithnicefeelings.duckdns.org | Remcos botnet C2 domain (confidence level: 50%) | |
domainafrica-wins.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domainlanguage-leading.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domainnewsletter-effects.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) |
File
| Value | Description | Copy |
|---|---|---|
file43.153.2.113 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file31.223.7.121 | DarkComet botnet C2 server (confidence level: 100%) | |
file47.108.136.66 | Unknown malware botnet C2 server (confidence level: 100%) | |
file193.26.115.188 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file172.81.133.115 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file157.90.192.89 | SectopRAT botnet C2 server (confidence level: 100%) | |
file109.120.137.254 | Hook botnet C2 server (confidence level: 100%) | |
file46.246.14.13 | DCRat botnet C2 server (confidence level: 100%) | |
file54.189.72.119 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file34.201.34.158 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file194.9.6.104 | Unknown malware botnet C2 server (confidence level: 100%) | |
file164.92.163.239 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file190.54.3.244 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file121.41.108.106 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file195.177.94.100 | Remcos botnet C2 server (confidence level: 100%) | |
file74.50.120.106 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file128.90.108.196 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file34.240.169.56 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file107.21.247.186 | Sliver botnet C2 server (confidence level: 90%) | |
file69.55.60.146 | Unknown malware botnet C2 server (confidence level: 100%) | |
file165.73.252.176 | DCRat botnet C2 server (confidence level: 100%) | |
file196.251.81.133 | Unknown malware botnet C2 server (confidence level: 100%) | |
file92.36.136.186 | Unknown malware botnet C2 server (confidence level: 100%) | |
file38.242.234.66 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.144.12.24 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.215.21.156 | Unknown malware botnet C2 server (confidence level: 100%) | |
file54.226.108.33 | Unknown malware botnet C2 server (confidence level: 100%) | |
file152.203.31.42 | Unknown malware botnet C2 server (confidence level: 100%) | |
file143.198.189.73 | Unknown malware botnet C2 server (confidence level: 100%) | |
file46.202.128.25 | Unknown malware botnet C2 server (confidence level: 100%) | |
file160.238.36.55 | Unknown malware botnet C2 server (confidence level: 100%) | |
file13.50.128.25 | Unknown malware botnet C2 server (confidence level: 100%) | |
file104.168.148.75 | Unknown malware botnet C2 server (confidence level: 100%) | |
file159.89.180.104 | Unknown malware botnet C2 server (confidence level: 100%) | |
file203.77.238.109 | Unknown malware botnet C2 server (confidence level: 100%) | |
file52.63.25.206 | Unknown malware botnet C2 server (confidence level: 100%) | |
file210.89.47.42 | Unknown malware botnet C2 server (confidence level: 100%) | |
file195.200.19.58 | Sliver botnet C2 server (confidence level: 50%) | |
file134.209.63.21 | Sliver botnet C2 server (confidence level: 50%) | |
file121.36.23.206 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file193.161.193.99 | XWorm botnet C2 server (confidence level: 50%) | |
file107.178.107.141 | XenoRAT botnet C2 server (confidence level: 100%) | |
file38.55.129.84 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.86.52.150 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file123.60.61.181 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file18.166.214.96 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file51.195.193.143 | Remcos botnet C2 server (confidence level: 100%) | |
file31.57.166.58 | Remcos botnet C2 server (confidence level: 100%) | |
file172.111.232.229 | Remcos botnet C2 server (confidence level: 100%) | |
file172.94.53.74 | Remcos botnet C2 server (confidence level: 100%) | |
file160.30.19.247 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.85.237 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file57.128.134.229 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file13.213.182.135 | Hook botnet C2 server (confidence level: 100%) | |
file166.88.225.113 | Havoc botnet C2 server (confidence level: 100%) | |
file121.199.75.77 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file113.44.92.25 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.108.172.28 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file103.79.186.245 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file146.70.87.138 | Rhysida botnet C2 server (confidence level: 75%) | |
file146.70.87.138 | Rhysida botnet C2 server (confidence level: 75%) | |
file2.91.184.1 | QakBot botnet C2 server (confidence level: 75%) | |
file23.184.48.240 | Havoc botnet C2 server (confidence level: 75%) | |
file38.132.122.161 | Eye Pyramid botnet C2 server (confidence level: 75%) | |
file46.101.140.228 | Sliver botnet C2 server (confidence level: 75%) | |
file62.72.36.127 | Havoc botnet C2 server (confidence level: 75%) | |
file178.250.188.144 | XWorm botnet C2 server (confidence level: 75%) | |
file95.217.27.252 | Vidar botnet C2 server (confidence level: 75%) | |
file206.123.152.99 | XWorm botnet C2 server (confidence level: 75%) | |
file144.202.85.30 | DarkGate botnet C2 server (confidence level: 75%) | |
file205.185.115.242 | Bashlite botnet C2 server (confidence level: 50%) | |
file117.72.41.61 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file117.72.47.60 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file101.37.116.219 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file101.37.116.219 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file156.238.233.109 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file154.40.44.195 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.93.218.189 | Remcos botnet C2 server (confidence level: 100%) | |
file194.15.216.113 | Sliver botnet C2 server (confidence level: 100%) | |
file18.162.191.208 | Unknown malware botnet C2 server (confidence level: 100%) | |
file23.94.207.135 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file107.178.103.149 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file107.178.103.149 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file195.58.58.58 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file195.58.58.58 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file52.209.223.124 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file188.214.129.216 | Meduza Stealer botnet C2 server (confidence level: 100%) | |
file47.239.165.225 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file147.185.221.26 | NjRAT botnet C2 server (confidence level: 75%) | |
file128.254.146.183 | FAKEUPDATES botnet C2 server (confidence level: 100%) | |
file18.220.30.194 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
file103.85.190.202 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file45.61.141.226 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file142.202.242.173 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
file5.181.159.60 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file20.189.112.107 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file45.92.1.33 | Remcos botnet C2 server (confidence level: 100%) | |
file93.123.118.40 | Remcos botnet C2 server (confidence level: 100%) | |
file192.3.220.21 | Remcos botnet C2 server (confidence level: 100%) | |
file196.251.81.165 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.116.95 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file107.148.41.31 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file107.174.39.161 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file185.43.4.72 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file154.8.160.34 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file69.61.84.210 | Remcos botnet C2 server (confidence level: 100%) | |
file37.221.64.232 | Remcos botnet C2 server (confidence level: 100%) | |
file45.129.2.63 | Sliver botnet C2 server (confidence level: 100%) | |
file91.206.178.111 | Sliver botnet C2 server (confidence level: 100%) | |
file62.192.174.138 | Sliver botnet C2 server (confidence level: 100%) | |
file161.35.40.73 | Sliver botnet C2 server (confidence level: 100%) | |
file136.243.111.71 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file104.219.236.202 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file128.90.108.156 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file134.209.226.202 | Unknown malware botnet C2 server (confidence level: 100%) | |
file20.229.219.117 | Unknown malware botnet C2 server (confidence level: 100%) | |
file213.209.150.193 | Hook botnet C2 server (confidence level: 100%) | |
file79.241.109.16 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file213.209.150.220 | Stealc botnet C2 server (confidence level: 100%) | |
file108.61.78.206 | Unknown malware botnet C2 server (confidence level: 75%) | |
file163.181.221.72 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file187.170.51.238 | QakBot botnet C2 server (confidence level: 75%) | |
file45.129.2.63 | Sliver botnet C2 server (confidence level: 75%) | |
file59.110.140.142 | Havoc botnet C2 server (confidence level: 75%) | |
file88.229.251.194 | QakBot botnet C2 server (confidence level: 75%) | |
file103.79.120.70 | PlugX botnet C2 server (confidence level: 90%) | |
file103.79.120.70 | PlugX botnet C2 server (confidence level: 90%) | |
file128.199.2.196 | Meterpreter botnet C2 server (confidence level: 75%) | |
file185.43.4.73 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file43.165.133.147 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file47.119.158.127 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file103.24.95.45 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file103.24.95.47 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file43.156.94.92 | Sliver botnet C2 server (confidence level: 50%) | |
file159.100.18.87 | Sliver botnet C2 server (confidence level: 50%) | |
file43.134.67.236 | Sliver botnet C2 server (confidence level: 50%) | |
file34.168.59.70 | Unknown malware botnet C2 server (confidence level: 50%) | |
file52.35.122.179 | Unknown malware botnet C2 server (confidence level: 50%) | |
file54.210.76.140 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file44.202.91.195 | BlackShades botnet C2 server (confidence level: 50%) | |
file188.127.224.20 | Remcos botnet C2 server (confidence level: 50%) | |
file147.185.221.26 | XWorm botnet C2 server (confidence level: 50%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7077 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash15748 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash80 | Hook botnet C2 server (confidence level: 100%) | |
hash9090 | DCRat botnet C2 server (confidence level: 100%) | |
hash37213 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9142 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash1337 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3898 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash10000 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Remcos botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash2000 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash19573 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 90%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash9999 | DCRat botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash5555 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash35830 | XWorm botnet C2 server (confidence level: 50%) | |
hash80 | XenoRAT botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Remcos botnet C2 server (confidence level: 100%) | |
hash8201 | Remcos botnet C2 server (confidence level: 100%) | |
hash8080 | Remcos botnet C2 server (confidence level: 100%) | |
hash8888 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | Hook botnet C2 server (confidence level: 100%) | |
hash15443 | Havoc botnet C2 server (confidence level: 100%) | |
hash9999 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2095 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7777 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | Rhysida botnet C2 server (confidence level: 75%) | |
hash80 | Rhysida botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | Havoc botnet C2 server (confidence level: 75%) | |
hash8888 | Eye Pyramid botnet C2 server (confidence level: 75%) | |
hash443 | Sliver botnet C2 server (confidence level: 75%) | |
hash443 | Havoc botnet C2 server (confidence level: 75%) | |
hash22635 | XWorm botnet C2 server (confidence level: 75%) | |
hash443 | Vidar botnet C2 server (confidence level: 75%) | |
hash3399 | XWorm botnet C2 server (confidence level: 75%) | |
hash80 | DarkGate botnet C2 server (confidence level: 75%) | |
hash54321 | Bashlite botnet C2 server (confidence level: 50%) | |
hash4000 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8088 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9876 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash8080 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash40000 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash80 | Meduza Stealer botnet C2 server (confidence level: 100%) | |
hash2053 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash21909 | NjRAT botnet C2 server (confidence level: 75%) | |
hash443 | FAKEUPDATES botnet C2 server (confidence level: 100%) | |
hash8000 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
hash6688 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash443 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
hash443 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash555 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash53 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash6009 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8081 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash20201 | Remcos botnet C2 server (confidence level: 100%) | |
hash8443 | Sliver botnet C2 server (confidence level: 100%) | |
hash8443 | Sliver botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash4443 | Sliver botnet C2 server (confidence level: 100%) | |
hash85 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash9999 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash82 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 75%) | |
hash4506 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash80 | Sliver botnet C2 server (confidence level: 75%) | |
hash3389 | Havoc botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash5000 | PlugX botnet C2 server (confidence level: 90%) | |
hash443 | PlugX botnet C2 server (confidence level: 90%) | |
hash4444 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash8001 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash9999 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash8123 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash8123 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash9067 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash33060 | BlackShades botnet C2 server (confidence level: 50%) | |
hash4578 | Remcos botnet C2 server (confidence level: 50%) | |
hash42069 | XWorm botnet C2 server (confidence level: 50%) |
Threat ID: 682c7dbce8347ec82d2c58de
Added to database: 5/20/2025, 1:03:56 PM
Last enriched: 6/19/2025, 3:34:46 PM
Last updated: 7/23/2025, 1:20:29 PM
Views: 13
Related Threats
Scattered Spider Launching Ransomware on Hijacked VMware Systems, Warns Google
MediumMalwareMon Jul 28 2025
RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration
MediumMalwareMon Jul 28 2025
ThreatFox IOCs for 2025-07-27
MediumMalwareMon Jul 28 2025
ThreatFox IOCs for 2025-07-26
MediumMalwareSun Jul 27 2025
Law enforcement operations seized BlackSuit ransomware gang’s darknet sites
MediumMalwareSat Jul 26 2025
Actions
PRO
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Please log in to the Console to use AI analysis features.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.