ThreatFox IOCs for 2025-03-08
Severity: mediumType: malware
ThreatFox IOCs for 2025-03-08
AI Analysis
Technical Summary
The provided threat intelligence concerns a malware-related report titled "ThreatFox IOCs for 2025-03-08," sourced from ThreatFox, an OSINT (Open Source Intelligence) platform. The report is dated March 8, 2025, and is categorized under the medium severity level. However, it lacks detailed technical indicators of compromise (IOCs), affected product versions, or specific malware family information. The threat level is indicated as 2 on an unspecified scale, with analysis and distribution scores of 1 and 3 respectively, suggesting moderate distribution potential but limited analytical detail. No known exploits in the wild have been reported, and there are no associated Common Weakness Enumerations (CWEs) or patch references. The absence of detailed technical data such as attack vectors, payload behavior, or targeted vulnerabilities limits the depth of technical understanding. Given the classification as OSINT and the presence of threat intelligence indicators, this likely represents a collection or dissemination of malware-related indicators rather than a direct exploit or active campaign. The lack of authentication or user interaction requirements is not explicitly stated, but the absence of exploit details suggests that exploitation complexity and prerequisites are unknown or minimal. Overall, this threat intelligence entry appears to be a medium-level alert about malware indicators collected and shared for awareness and defensive purposes rather than an immediate, active threat with known exploitation methods.
Potential Impact
For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, the dissemination of malware-related IOCs can aid attackers in reconnaissance or preparation phases, potentially leading to future targeted attacks. Organizations relying on OSINT feeds for threat detection may benefit from integrating these indicators into their security monitoring to enhance early warning capabilities. The medium severity rating suggests a moderate risk, possibly due to the malware's distribution potential or the sensitivity of targeted sectors. If leveraged by threat actors, such malware could compromise confidentiality, integrity, or availability depending on its payload, which remains unspecified. European entities in critical infrastructure, finance, or government sectors should remain vigilant, as these sectors are frequent targets for malware campaigns. The absence of known exploits in the wild reduces immediate risk but does not preclude future exploitation. Therefore, the impact is primarily in the realm of preparedness and threat intelligence enrichment rather than direct operational disruption at this stage.
Mitigation Recommendations
Given the limited technical details, mitigation should focus on enhancing threat intelligence integration and proactive defense measures. European organizations should: 1) Incorporate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to detect emerging IOCs promptly. 2) Conduct regular threat hunting exercises using the latest malware indicators to identify potential compromises early. 3) Maintain up-to-date patch management practices even though no specific patches are linked, as malware often exploits known vulnerabilities. 4) Strengthen network segmentation and implement strict access controls to limit malware propagation if infection occurs. 5) Educate staff on recognizing phishing and social engineering tactics, as these are common malware delivery vectors. 6) Collaborate with national Computer Emergency Response Teams (CERTs) and share intelligence to enhance collective defense. These steps go beyond generic advice by emphasizing integration of OSINT feeds and active threat hunting tailored to the evolving malware landscape indicated by ThreatFox.
Affected Countries
Germany, France, United Kingdom, Italy, Netherlands, Spain, Poland
Indicators of Compromise
- domain: check.qulin.icu
- domain: check.socek.icu
- domain: check.gerit.icu
- url: https://livlivprolivasdvaa.shop/api
- url: https://interfensuffer.fun/api
- url: https://other-rans.cyou/api
- url: https://childishbagge.fun/api
- url: https://my-tasjeel-ae.com/getid.js
- url: https://spain-playmarket.com/chrome/update/
- file: 101.200.76.102
- hash: 443
- file: 20.189.117.246
- hash: 221
- file: 39.103.57.189
- hash: 80
- file: 43.139.221.182
- hash: 8888
- file: 43.139.221.182
- hash: 8080
- file: 43.139.221.182
- hash: 8848
- file: 181.235.189.1
- hash: 8888
- file: 190.144.146.90
- hash: 5508
- file: 104.250.169.99
- hash: 3191
- file: 196.251.93.4
- hash: 2404
- file: 37.48.71.106
- hash: 443
- file: 46.246.86.8
- hash: 8888
- file: 196.251.70.67
- hash: 8808
- file: 74.50.120.69
- hash: 2003
- file: 196.251.71.246
- hash: 8808
- file: 194.13.81.122
- hash: 7443
- file: 91.134.72.203
- hash: 7443
- file: 213.209.150.182
- hash: 8089
- file: 183.101.23.154
- hash: 443
- file: 109.207.172.177
- hash: 5555
- file: 81.230.52.105
- hash: 25565
- file: 40.76.113.240
- hash: 443
- domain: cpcontacts.start7pros.xyz
- domain: webmail.mtpolice077.website
- domain: cpcalendars.paranewslivesab.xyz
- domain: webdisk.10bestbusiness.xyz
- domain: ec2-18-97-23-200.compute-1.amazonaws.com
- domain: webdisk.handufabetgames.xyz
- domain: cpcalendars.techgambuzz.xyz
- domain: webmail.eragamshub.xyz
- domain: webmail.bottomofbusiness.xyz
- domain: cpcalendars.bsttoolswx.website
- file: 216.219.83.86
- hash: 3976
- file: 35.183.43.83
- hash: 43766
- file: 54.168.200.156
- hash: 37215
- url: http://192.10.136.219:34446/mozi.m
- url: http://www.orway.bplaced.net/pony/gate.php
- file: 52.255.166.103
- hash: 443
- file: 103.17.38.43
- hash: 7707
- file: 103.17.38.43
- hash: 3232
- file: 103.17.38.43
- hash: 4449
- file: 45.204.194.231
- hash: 443
- file: 192.253.231.230
- hash: 80
- file: 155.254.245.47
- hash: 8080
- file: 45.137.22.227
- hash: 2404
- file: 196.251.71.135
- hash: 443
- file: 146.56.203.178
- hash: 8888
- file: 172.111.162.203
- hash: 8080
- file: 91.134.72.203
- hash: 80
- file: 179.13.2.158
- hash: 8082
- file: 88.214.57.220
- hash: 4782
- file: 196.251.73.248
- hash: 443
- file: 38.132.122.177
- hash: 10443
- domain: cpcontacts.8761gamesofarts.xyz
- domain: webmail.businesswithloyal.website
- domain: cpanel.modegenerlshub.xyz
- domain: cpcalendars.ranknewzmedia.com
- file: 157.20.182.80
- hash: 4449
- file: 113.44.89.84
- hash: 4444
- domain: webdisk.timehrnews.com
- domain: cpcontacts.gamesofsportsandtoto.com
- domain: cpanel.canvatechsports.com
- file: 172.245.126.78
- hash: 60000
- file: 52.66.229.131
- hash: 443
- file: 164.90.225.126
- hash: 3333
- file: 35.231.18.148
- hash: 3333
- file: 121.43.152.104
- hash: 3333
- file: 54.191.118.2
- hash: 80
- file: 188.245.60.230
- hash: 443
- file: 18.234.211.164
- hash: 80
- file: 54.185.242.138
- hash: 80
- file: 200.69.21.128
- hash: 8080
- file: 3.25.0.184
- hash: 443
- file: 135.181.93.238
- hash: 7777
- file: 8.134.183.77
- hash: 3333
- file: 200.69.21.61
- hash: 443
- file: 173.212.236.196
- hash: 3434
- file: 3.6.43.252
- hash: 443
- file: 142.93.156.214
- hash: 3333
- file: 175.27.230.184
- hash: 8888
- file: 3.220.111.248
- hash: 443
- file: 135.125.239.213
- hash: 3333
- file: 147.185.221.24
- hash: 16528
- file: 147.185.221.25
- hash: 15635
- domain: treatment-met.gl.at.ply.gg
- domain: check.kutyl.icu
- domain: check.matur.icu
- domain: check.zudab.icu
- domain: check.tuqyq.icu
- domain: check.wanah.icu
- url: https://matkldwide.digital/api
- url: https://sngugglepillow.live/api
- url: https://chemistrycworner.today/api
- url: https://sdfwfsdf.icu/api
- url: https://resrtfulnights.live/api
- url: https://nexustrade.club/
- url: https://twitch.care/4ut1
- url: https://fb.com100112032113.link/
- file: 45.155.53.49
- hash: 4400
- domain: 4.ip.gl.ply.gg
- domain: customer-performances.gl.at.ply.gg
- domain: defined-literary.gl.at.ply.gg
- domain: freeetradingzone.duckdns.org
- domain: stay-type.gl.at.ply.gg
- file: 147.185.221.26
- hash: 46374
- domain: lydbonkersbimpjc.blogspot.com
- domain: bookimanagerev.com
- domain: cpth-cant.com
- domain: hrewsburysocialclub.org
- domain: check.nuhiq.icu
- domain: check.fyvuz.icu
- file: 45.185.208.131
- hash: 2404
- file: 45.137.99.121
- hash: 31337
- file: 196.251.72.206
- hash: 8888
- file: 176.65.144.19
- hash: 7707
- file: 73.237.81.57
- hash: 8080
- file: 66.70.238.102
- hash: 8080
- domain: ip72.ip-198-244-227.eu
- domain: cpcontacts.totogamesnetwork.com
- domain: webdisk.bestnewznetworkofone.com
- file: 101.99.92.124
- hash: 443
- file: 117.187.7.109
- hash: 4506
- file: 13.244.66.40
- hash: 81
- file: 196.251.71.135
- hash: 4443
- file: 207.60.50.75
- hash: 443
- file: 45.137.99.121
- hash: 8888
- file: 147.45.112.220
- hash: 8443
- file: 120.26.136.6
- hash: 80
- file: 1.95.83.118
- hash: 8443
- file: 13.200.162.35
- hash: 7777
- file: 196.251.70.197
- hash: 80
- file: 8.137.109.17
- hash: 9999
- domain: check.votao.icu
- domain: check.havye.icu
- url: http://152.36.128.18/cgi-bin/p.cgi
- file: 152.36.128.18
- hash: 80
- domain: acer.tail843d69.ts.net
- domain: josefnnnnn.no-ip.biz
- domain: torbrowser.no-ip.biz
- domain: data-center.gotdns.ch
- domain: bossik.ddns.net
- file: 185.82.217.154
- hash: 48589
- file: 100.96.164.62
- hash: 2828
- url: http://h2slq.store/pl341/index.php
- url: https://guifenergy.co.ke/bin/32/index.php
- file: 58.181.61.142
- hash: 8286
- file: 8.217.32.119
- hash: 443
- file: 119.8.99.254
- hash: 80
- file: 192.52.242.31
- hash: 2404
- file: 15.160.134.180
- hash: 8443
- file: 107.174.64.180
- hash: 8888
- file: 38.55.201.108
- hash: 8888
- file: 154.12.224.140
- hash: 8808
- file: 46.246.86.8
- hash: 9999
- file: 86.38.225.152
- hash: 808
- file: 196.251.85.13
- hash: 4782
- file: 181.162.131.55
- hash: 8080
- domain: cpanel.okiamwithtotogames.com
- domain: webdisk.topandbestnews.com
- domain: cpanel.sportsdhub.com
- domain: cpcontacts.topdigihub.com
- file: 154.12.94.10
- hash: 80
- domain: check.rehoe.icu
- domain: moscable77.ru
- file: 196.251.71.245
- hash: 443
- file: 198.13.33.74
- hash: 443
- file: 213.209.150.218
- hash: 443
- domain: check.jomea.icu
- url: https://livestveblog.live/api
- url: https://vtechspherxe.top/api
- url: https://3orangemyther.live/api
- url: https://7garagedrootz.top/api
- url: https://7modelshiverd.icu/api
- url: https://oearthsymphzony.today/api
- url: https://9sterpickced.digital/api
- domain: check.xagoe.icu
- domain: check.muqey.icu
- url: https://5ktechmindzs.live/api
- url: https://6codxefusion.top/api
- url: https://7phygcsforum.life/api
- url: https://larisechairedd.shop/api
- url: https://q8explorebieology.run/api
- url: https://xsterpickced.digital/api
- url: https://ycatterjur.run/api
- file: 62.60.234.80
- hash: 1466
- file: 150.95.115.184
- hash: 443
- file: 138.68.135.168
- hash: 80
- file: 47.79.41.42
- hash: 80
- file: 113.44.164.75
- hash: 8888
- file: 103.142.102.1
- hash: 8888
- file: 196.251.71.233
- hash: 9999
- file: 212.129.34.197
- hash: 8808
- file: 179.13.2.158
- hash: 8081
- file: 176.65.144.60
- hash: 7707
- file: 216.164.152.116
- hash: 3334
- file: 201.43.190.13
- hash: 8081
- domain: cpcalendars.hostsportstoto9.com
- domain: webmail.bestblogznews.com
- domain: cpcontacts.sportsfootball.website
- url: http://207405cm.nyashk.ru/secureflower.php
- file: 89.105.201.98
- hash: 8888
- domain: check.cijii.icu
- file: 139.224.15.61
- hash: 80
- file: 148.135.73.168
- hash: 443
- file: 1.92.148.33
- hash: 80
- file: 1.94.56.124
- hash: 80
- file: 173.225.101.112
- hash: 7394
- file: 43.226.229.207
- hash: 2404
- file: 31.57.166.72
- hash: 443
- file: 140.119.97.32
- hash: 8888
- domain: webmail.broadcnnewz.xyz
- domain: cpcontacts.viralbookshub.xyz
- domain: webdisk.fivetopbusiness.website
- domain: srv15118837.ultasrv.net
- domain: cpcontacts.businesswithloyal.xyz
- domain: cpanel.top10gamesofoto1.xyz
- domain: cpanel.newdmkey.xyz
- domain: webmail.stockmrtktlite.xyz
- domain: cpcalendars.wellcartnewzhub.xyz
- domain: cpcalendars.homeimprovementbox.xyz
- domain: cpcontacts.betufa.website
- domain: cpcontacts.10bestufabetgames.xyz
- domain: cpanel.police-mt077.website
- file: 115.91.26.76
- hash: 9999
- file: 13.53.216.242
- hash: 2376
- file: 13.53.216.242
- hash: 9876
- file: 143.198.18.85
- hash: 9848
- file: 176.44.55.132
- hash: 995
- file: 39.40.131.191
- hash: 995
- file: 5.12.238.195
- hash: 443
- url: https://check.juxoi.icu/gkcxv.google
ThreatFox IOCs for 2025-03-08
Medium
Published: Sat Mar 08 2025 (03/08/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2025-03-08
AI-Powered Analysis
AILast updated: 06/19/2025, 15:17:35 UTC
Technical Analysis
The provided threat intelligence concerns a malware-related report titled "ThreatFox IOCs for 2025-03-08," sourced from ThreatFox, an OSINT (Open Source Intelligence) platform. The report is dated March 8, 2025, and is categorized under the medium severity level. However, it lacks detailed technical indicators of compromise (IOCs), affected product versions, or specific malware family information. The threat level is indicated as 2 on an unspecified scale, with analysis and distribution scores of 1 and 3 respectively, suggesting moderate distribution potential but limited analytical detail. No known exploits in the wild have been reported, and there are no associated Common Weakness Enumerations (CWEs) or patch references. The absence of detailed technical data such as attack vectors, payload behavior, or targeted vulnerabilities limits the depth of technical understanding. Given the classification as OSINT and the presence of threat intelligence indicators, this likely represents a collection or dissemination of malware-related indicators rather than a direct exploit or active campaign. The lack of authentication or user interaction requirements is not explicitly stated, but the absence of exploit details suggests that exploitation complexity and prerequisites are unknown or minimal. Overall, this threat intelligence entry appears to be a medium-level alert about malware indicators collected and shared for awareness and defensive purposes rather than an immediate, active threat with known exploitation methods.
Potential Impact
For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, the dissemination of malware-related IOCs can aid attackers in reconnaissance or preparation phases, potentially leading to future targeted attacks. Organizations relying on OSINT feeds for threat detection may benefit from integrating these indicators into their security monitoring to enhance early warning capabilities. The medium severity rating suggests a moderate risk, possibly due to the malware's distribution potential or the sensitivity of targeted sectors. If leveraged by threat actors, such malware could compromise confidentiality, integrity, or availability depending on its payload, which remains unspecified. European entities in critical infrastructure, finance, or government sectors should remain vigilant, as these sectors are frequent targets for malware campaigns. The absence of known exploits in the wild reduces immediate risk but does not preclude future exploitation. Therefore, the impact is primarily in the realm of preparedness and threat intelligence enrichment rather than direct operational disruption at this stage.
Mitigation Recommendations
Given the limited technical details, mitigation should focus on enhancing threat intelligence integration and proactive defense measures. European organizations should: 1) Incorporate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to detect emerging IOCs promptly. 2) Conduct regular threat hunting exercises using the latest malware indicators to identify potential compromises early. 3) Maintain up-to-date patch management practices even though no specific patches are linked, as malware often exploits known vulnerabilities. 4) Strengthen network segmentation and implement strict access controls to limit malware propagation if infection occurs. 5) Educate staff on recognizing phishing and social engineering tactics, as these are common malware delivery vectors. 6) Collaborate with national Computer Emergency Response Teams (CERTs) and share intelligence to enhance collective defense. These steps go beyond generic advice by emphasizing integration of OSINT feeds and active threat hunting tailored to the evolving malware landscape indicated by ThreatFox.
Affected Countries
Need more detailed analysis?Get Pro
Pro Feature
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- dda4987a-36f4-4184-b2a7-70e437c0b514
- Original Timestamp
- 1741478589
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domaincheck.qulin.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.socek.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.gerit.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpcontacts.start7pros.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.mtpolice077.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.paranewslivesab.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.10bestbusiness.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainec2-18-97-23-200.compute-1.amazonaws.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.handufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.techgambuzz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.eragamshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.bottomofbusiness.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.bsttoolswx.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.8761gamesofarts.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.businesswithloyal.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.modegenerlshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.ranknewzmedia.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.timehrnews.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.gamesofsportsandtoto.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.canvatechsports.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaintreatment-met.gl.at.ply.gg | NjRAT botnet C2 domain (confidence level: 75%) | |
domaincheck.kutyl.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.matur.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.zudab.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.tuqyq.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.wanah.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domain4.ip.gl.ply.gg | NjRAT botnet C2 domain (confidence level: 50%) | |
domaincustomer-performances.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domaindefined-literary.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domainfreeetradingzone.duckdns.org | XWorm botnet C2 domain (confidence level: 50%) | |
domainstay-type.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domainlydbonkersbimpjc.blogspot.com | Unknown malware payload delivery domain (confidence level: 50%) | |
domainbookimanagerev.com | Unknown malware payload delivery domain (confidence level: 50%) | |
domaincpth-cant.com | Unknown malware payload delivery domain (confidence level: 50%) | |
domainhrewsburysocialclub.org | Unknown Loader botnet C2 domain (confidence level: 50%) | |
domaincheck.nuhiq.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.fyvuz.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainip72.ip-198-244-227.eu | Quasar RAT botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.totogamesnetwork.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.bestnewznetworkofone.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincheck.votao.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.havye.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainacer.tail843d69.ts.net | NjRAT botnet C2 domain (confidence level: 100%) | |
domainjosefnnnnn.no-ip.biz | NjRAT botnet C2 domain (confidence level: 100%) | |
domaintorbrowser.no-ip.biz | NjRAT botnet C2 domain (confidence level: 100%) | |
domaindata-center.gotdns.ch | NjRAT botnet C2 domain (confidence level: 100%) | |
domainbossik.ddns.net | NjRAT botnet C2 domain (confidence level: 100%) | |
domaincpanel.okiamwithtotogames.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.topandbestnews.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.sportsdhub.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.topdigihub.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincheck.rehoe.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainmoscable77.ru | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domaincheck.jomea.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.xagoe.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.muqey.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpcalendars.hostsportstoto9.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.bestblogznews.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.sportsfootball.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincheck.cijii.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainwebmail.broadcnnewz.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.viralbookshub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebdisk.fivetopbusiness.website | Havoc botnet C2 domain (confidence level: 100%) | |
domainsrv15118837.ultasrv.net | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.businesswithloyal.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.top10gamesofoto1.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.newdmkey.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domainwebmail.stockmrtktlite.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.wellcartnewzhub.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.homeimprovementbox.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.betufa.website | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.10bestufabetgames.xyz | Havoc botnet C2 domain (confidence level: 100%) | |
domaincpanel.police-mt077.website | Havoc botnet C2 domain (confidence level: 100%) |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://livlivprolivasdvaa.shop/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://interfensuffer.fun/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://other-rans.cyou/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://childishbagge.fun/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://my-tasjeel-ae.com/getid.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://spain-playmarket.com/chrome/update/ | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttp://192.10.136.219:34446/mozi.m | Mozi payload delivery URL (confidence level: 50%) | |
urlhttp://www.orway.bplaced.net/pony/gate.php | Pony botnet C2 (confidence level: 100%) | |
urlhttps://matkldwide.digital/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://sngugglepillow.live/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://chemistrycworner.today/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://sdfwfsdf.icu/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://resrtfulnights.live/api | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://nexustrade.club/ | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://twitch.care/4ut1 | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttps://fb.com100112032113.link/ | Unknown malware payload delivery URL (confidence level: 50%) | |
urlhttp://152.36.128.18/cgi-bin/p.cgi | Prometei botnet C2 (confidence level: 100%) | |
urlhttp://h2slq.store/pl341/index.php | Azorult botnet C2 (confidence level: 100%) | |
urlhttps://guifenergy.co.ke/bin/32/index.php | Azorult botnet C2 (confidence level: 100%) | |
urlhttps://livestveblog.live/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://vtechspherxe.top/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://3orangemyther.live/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://7garagedrootz.top/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://7modelshiverd.icu/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://oearthsymphzony.today/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://9sterpickced.digital/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://5ktechmindzs.live/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://6codxefusion.top/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://7phygcsforum.life/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://larisechairedd.shop/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://q8explorebieology.run/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://xsterpickced.digital/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://ycatterjur.run/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://207405cm.nyashk.ru/secureflower.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://check.juxoi.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) |
File
| Value | Description | Copy |
|---|---|---|
file101.200.76.102 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file20.189.117.246 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file39.103.57.189 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file43.139.221.182 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file43.139.221.182 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file43.139.221.182 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file181.235.189.1 | Remcos botnet C2 server (confidence level: 100%) | |
file190.144.146.90 | Remcos botnet C2 server (confidence level: 100%) | |
file104.250.169.99 | Remcos botnet C2 server (confidence level: 100%) | |
file196.251.93.4 | Remcos botnet C2 server (confidence level: 100%) | |
file37.48.71.106 | Sliver botnet C2 server (confidence level: 100%) | |
file46.246.86.8 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.70.67 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file74.50.120.69 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.71.246 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file194.13.81.122 | Unknown malware botnet C2 server (confidence level: 100%) | |
file91.134.72.203 | Unknown malware botnet C2 server (confidence level: 100%) | |
file213.209.150.182 | Hook botnet C2 server (confidence level: 100%) | |
file183.101.23.154 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file109.207.172.177 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file81.230.52.105 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file40.76.113.240 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file216.219.83.86 | DCRat botnet C2 server (confidence level: 100%) | |
file35.183.43.83 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file54.168.200.156 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file52.255.166.103 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file103.17.38.43 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file103.17.38.43 | AsyncRAT botnet C2 server (confidence level: 75%) | |
file103.17.38.43 | AsyncRAT botnet C2 server (confidence level: 75%) | |
file45.204.194.231 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file192.253.231.230 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file155.254.245.47 | Remcos botnet C2 server (confidence level: 100%) | |
file45.137.22.227 | Remcos botnet C2 server (confidence level: 100%) | |
file196.251.71.135 | Sliver botnet C2 server (confidence level: 100%) | |
file146.56.203.178 | Unknown malware botnet C2 server (confidence level: 100%) | |
file172.111.162.203 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file91.134.72.203 | Unknown malware botnet C2 server (confidence level: 100%) | |
file179.13.2.158 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file88.214.57.220 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file196.251.73.248 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file38.132.122.177 | Havoc botnet C2 server (confidence level: 100%) | |
file157.20.182.80 | Venom RAT botnet C2 server (confidence level: 100%) | |
file113.44.89.84 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.245.126.78 | Unknown malware botnet C2 server (confidence level: 100%) | |
file52.66.229.131 | Unknown malware botnet C2 server (confidence level: 100%) | |
file164.90.225.126 | Unknown malware botnet C2 server (confidence level: 100%) | |
file35.231.18.148 | Unknown malware botnet C2 server (confidence level: 100%) | |
file121.43.152.104 | Unknown malware botnet C2 server (confidence level: 100%) | |
file54.191.118.2 | Unknown malware botnet C2 server (confidence level: 100%) | |
file188.245.60.230 | Unknown malware botnet C2 server (confidence level: 100%) | |
file18.234.211.164 | Unknown malware botnet C2 server (confidence level: 100%) | |
file54.185.242.138 | Unknown malware botnet C2 server (confidence level: 100%) | |
file200.69.21.128 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.25.0.184 | Unknown malware botnet C2 server (confidence level: 100%) | |
file135.181.93.238 | Unknown malware botnet C2 server (confidence level: 100%) | |
file8.134.183.77 | Unknown malware botnet C2 server (confidence level: 100%) | |
file200.69.21.61 | Unknown malware botnet C2 server (confidence level: 100%) | |
file173.212.236.196 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.6.43.252 | Unknown malware botnet C2 server (confidence level: 100%) | |
file142.93.156.214 | Unknown malware botnet C2 server (confidence level: 100%) | |
file175.27.230.184 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.220.111.248 | Unknown malware botnet C2 server (confidence level: 100%) | |
file135.125.239.213 | Unknown malware botnet C2 server (confidence level: 100%) | |
file147.185.221.24 | NjRAT botnet C2 server (confidence level: 75%) | |
file147.185.221.25 | NjRAT botnet C2 server (confidence level: 75%) | |
file45.155.53.49 | DCRat botnet C2 server (confidence level: 50%) | |
file147.185.221.26 | XWorm botnet C2 server (confidence level: 50%) | |
file45.185.208.131 | Remcos botnet C2 server (confidence level: 100%) | |
file45.137.99.121 | Sliver botnet C2 server (confidence level: 100%) | |
file196.251.72.206 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file176.65.144.19 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file73.237.81.57 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file66.70.238.102 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file101.99.92.124 | DanaBot botnet C2 server (confidence level: 75%) | |
file117.187.7.109 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file13.244.66.40 | NetSupportManager RAT botnet C2 server (confidence level: 75%) | |
file196.251.71.135 | Sliver botnet C2 server (confidence level: 75%) | |
file207.60.50.75 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file45.137.99.121 | Sliver botnet C2 server (confidence level: 75%) | |
file147.45.112.220 | Meterpreter botnet C2 server (confidence level: 75%) | |
file120.26.136.6 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.95.83.118 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file13.200.162.35 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file196.251.70.197 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file8.137.109.17 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file152.36.128.18 | Prometei botnet C2 server (confidence level: 100%) | |
file185.82.217.154 | NjRAT botnet C2 server (confidence level: 100%) | |
file100.96.164.62 | NjRAT botnet C2 server (confidence level: 100%) | |
file58.181.61.142 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file8.217.32.119 | PlugX botnet C2 server (confidence level: 75%) | |
file119.8.99.254 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file192.52.242.31 | Remcos botnet C2 server (confidence level: 100%) | |
file15.160.134.180 | Sliver botnet C2 server (confidence level: 100%) | |
file107.174.64.180 | Unknown malware botnet C2 server (confidence level: 100%) | |
file38.55.201.108 | Unknown malware botnet C2 server (confidence level: 100%) | |
file154.12.224.140 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file46.246.86.8 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file86.38.225.152 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.85.13 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file181.162.131.55 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file154.12.94.10 | MooBot botnet C2 server (confidence level: 100%) | |
file196.251.71.245 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file198.13.33.74 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file213.209.150.218 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file62.60.234.80 | HijackLoader botnet C2 server (confidence level: 50%) | |
file150.95.115.184 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file138.68.135.168 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.79.41.42 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file113.44.164.75 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file103.142.102.1 | Unknown malware botnet C2 server (confidence level: 100%) | |
file196.251.71.233 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file212.129.34.197 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file179.13.2.158 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file176.65.144.60 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file216.164.152.116 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file201.43.190.13 | Havoc botnet C2 server (confidence level: 100%) | |
file89.105.201.98 | AsyncRAT botnet C2 server (confidence level: 75%) | |
file139.224.15.61 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file148.135.73.168 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.92.148.33 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.94.56.124 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file173.225.101.112 | Remcos botnet C2 server (confidence level: 100%) | |
file43.226.229.207 | Remcos botnet C2 server (confidence level: 100%) | |
file31.57.166.72 | Remcos botnet C2 server (confidence level: 100%) | |
file140.119.97.32 | Unknown malware botnet C2 server (confidence level: 100%) | |
file115.91.26.76 | DCRat botnet C2 server (confidence level: 100%) | |
file13.53.216.242 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file13.53.216.242 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file143.198.18.85 | Sliver botnet C2 server (confidence level: 75%) | |
file176.44.55.132 | QakBot botnet C2 server (confidence level: 75%) | |
file39.40.131.191 | QakBot botnet C2 server (confidence level: 75%) | |
file5.12.238.195 | QakBot botnet C2 server (confidence level: 75%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash221 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8848 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Remcos botnet C2 server (confidence level: 100%) | |
hash5508 | Remcos botnet C2 server (confidence level: 100%) | |
hash3191 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash2003 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash5555 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash25565 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash3976 | DCRat botnet C2 server (confidence level: 100%) | |
hash43766 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash37215 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash3232 | AsyncRAT botnet C2 server (confidence level: 75%) | |
hash4449 | AsyncRAT botnet C2 server (confidence level: 75%) | |
hash443 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8082 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash4782 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash10443 | Havoc botnet C2 server (confidence level: 100%) | |
hash4449 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash4444 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7777 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3434 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash16528 | NjRAT botnet C2 server (confidence level: 75%) | |
hash15635 | NjRAT botnet C2 server (confidence level: 75%) | |
hash4400 | DCRat botnet C2 server (confidence level: 50%) | |
hash46374 | XWorm botnet C2 server (confidence level: 50%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash31337 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8080 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | DanaBot botnet C2 server (confidence level: 75%) | |
hash4506 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash81 | NetSupportManager RAT botnet C2 server (confidence level: 75%) | |
hash4443 | Sliver botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash8888 | Sliver botnet C2 server (confidence level: 75%) | |
hash8443 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7777 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9999 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Prometei botnet C2 server (confidence level: 100%) | |
hash48589 | NjRAT botnet C2 server (confidence level: 100%) | |
hash2828 | NjRAT botnet C2 server (confidence level: 100%) | |
hash8286 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash443 | PlugX botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash8443 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash9999 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash4782 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash80 | MooBot botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash1466 | HijackLoader botnet C2 server (confidence level: 50%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash9999 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8081 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash3334 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash8081 | Havoc botnet C2 server (confidence level: 100%) | |
hash8888 | AsyncRAT botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7394 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Remcos botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash9999 | DCRat botnet C2 server (confidence level: 100%) | |
hash2376 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9876 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9848 | Sliver botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) |
Threat ID: 682c7dbce8347ec82d2c4c1e
Added to database: 5/20/2025, 1:03:56 PM
Last enriched: 6/19/2025, 3:17:35 PM
Last updated: 7/7/2025, 9:24:34 PM
Views: 6
Related Threats
ThreatFox IOCs for 2025-07-09
MediumMalwareThu Jul 10 2025
Iranian group Pay2Key.I2P ramps Up ransomware attacks against Israel and US with incentives for affiliates
MediumMalwareWed Jul 09 2025
Exploitation of Leaked Machine Keys by Initial Access Broker
MediumMalwareWed Jul 09 2025
Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads
MediumMalwareWed Jul 09 2025
Bypassing Live HTML Filtering to Trigger Stored XSS – DOM-Based Exploitation
MediumMalwareWed Jul 09 2025
Actions
PRO
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Please log in to the Console to use AI analysis features.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.