ThreatFox IOCs for 2025-04-11
Severity: mediumType: malware
ThreatFox IOCs for 2025-04-11
AI Analysis
Technical Summary
The provided threat information pertains to a malware-related intelligence report titled "ThreatFox IOCs for 2025-04-11," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The report is categorized under "type:osint," indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. There are no affected product versions listed, and no specific Common Weakness Enumerations (CWEs) or patch links are provided, suggesting that this report serves as a collection or update of IOCs rather than detailing a new vulnerability or exploit. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, which may imply moderate threat presence and distribution but limited analysis depth. Notably, there are no known exploits in the wild associated with this threat at the time of publication, and no indicators are explicitly listed in the provided data. The absence of detailed technical indicators or exploit information limits the ability to assess the malware's behavior, infection vectors, or payload specifics. Overall, this report appears to be a routine update of threat intelligence data rather than an alert about an active or emerging critical threat.
Potential Impact
Given the limited technical details and absence of known exploits in the wild, the immediate impact on European organizations is likely to be low to medium. Since the threat is categorized under OSINT and lacks specific affected products or vulnerabilities, it may primarily serve as background intelligence that could inform defensive measures rather than representing an active attack vector. However, organizations relying heavily on open-source threat intelligence feeds or those involved in cybersecurity operations might find value in integrating these IOCs to enhance detection capabilities. The potential impact on confidentiality, integrity, or availability is minimal without evidence of active exploitation or targeted attacks. Nonetheless, the distribution rating suggests some level of propagation or sharing of this intelligence, which could precede or accompany more significant threats. European organizations in sectors with high exposure to malware threats, such as finance, critical infrastructure, or government, should remain vigilant but are not currently at elevated risk from this specific report.
Mitigation Recommendations
1. Integrate the provided IOCs from ThreatFox into existing Security Information and Event Management (SIEM) and endpoint detection and response (EDR) tools to enhance detection capabilities, even if no active exploits are currently known. 2. Maintain up-to-date threat intelligence feeds and ensure that security teams regularly review and correlate OSINT data with internal logs to identify potential early indicators of compromise. 3. Conduct regular training for security analysts on interpreting and operationalizing OSINT-derived IOCs to improve response times and accuracy. 4. Implement network segmentation and strict access controls to limit potential malware spread should any related threats emerge. 5. Continuously monitor for updates from ThreatFox and other reputable sources to quickly adapt defenses if new exploit information or active campaigns are reported. 6. Avoid reliance solely on automated ingestion of OSINT data; incorporate human analysis to validate the relevance and accuracy of IOCs before operational use.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy
Indicators of Compromise
- file: 192.169.69.26
- hash: 1605
- file: 147.185.221.19
- hash: 6863
- domain: pack-amber.gl.at.ply.gg
- domain: pdel.tsyndicate.com
- domain: psub.tsyndicate.com
- domain: pdel.tsyndicate.com
- domain: psub.tsyndicate.com
- file: 139.45.197.252
- hash: 443
- file: 139.45.197.252
- hash: 443
- file: 147.185.221.27
- hash: 19766
- domain: get-met.gl.at.ply.gg
- file: 176.65.141.245
- hash: 80
- file: 185.196.11.208
- hash: 443
- file: 14.103.131.223
- hash: 443
- file: 196.251.116.165
- hash: 8808
- file: 38.69.8.179
- hash: 80
- file: 38.69.8.179
- hash: 443
- file: 128.90.106.149
- hash: 8808
- file: 78.164.223.72
- hash: 8808
- domain: lummamarket.com
- domain: lumc2-market.fun
- file: 144.172.89.56
- hash: 8082
- file: 23.146.40.48
- hash: 2095
- file: 167.99.42.160
- hash: 4000
- domain: cpcalendars.aaa.104-168-101-27.cprapid.com
- file: 64.176.220.177
- hash: 443
- domain: check.xiwuc.icu
- url: https://check.xiwuc.icu/gkcxv.google
- file: 87.121.84.211
- hash: 8080
- url: http://61.3.137.100:44479/mozi.m
- url: http://14.102.189.30:58105/mozi.m
- file: 185.39.19.50
- hash: 424
- file: 185.39.19.50
- hash: 431
- file: 185.39.19.50
- hash: 417
- file: 185.39.19.50
- hash: 416
- file: 185.39.19.51
- hash: 428
- file: 185.39.19.50
- hash: 421
- url: https://modproz.run/opqz
- file: 185.39.19.51
- hash: 429
- file: 185.39.19.50
- hash: 418
- file: 165.154.112.217
- hash: 443
- file: 102.117.170.21
- hash: 7443
- file: 77.105.161.131
- hash: 80
- file: 209.38.23.41
- hash: 443
- file: 103.45.68.160
- hash: 808
- file: 38.147.187.21
- hash: 60000
- file: 192.159.99.119
- hash: 1000
- file: 43.255.159.28
- hash: 60000
- file: 23.95.168.170
- hash: 3335
- file: 34.51.128.91
- hash: 3333
- file: 35.83.81.194
- hash: 443
- file: 82.115.223.2
- hash: 443
- file: 54.153.134.100
- hash: 443
- file: 54.245.193.7
- hash: 443
- file: 139.196.24.58
- hash: 7878
- file: 35.184.140.77
- hash: 443
- file: 16.171.171.2
- hash: 3333
- file: 3.255.204.251
- hash: 443
- file: 101.108.135.165
- hash: 7443
- file: 108.181.155.15
- hash: 80
- file: 108.181.155.15
- hash: 8080
- domain: cpcalendars.c.multi-canale.com
- url: https://u1.entouragescuff.shop/35bf3fcr80.aac
- domain: u1.entouragescuff.shop
- url: https://d1.dyfot.fun/d6d0c07fe5ee8c61f23e1cf95c5035fc
- domain: d1.dyfot.fun
- domain: check.zevyg.icu
- url: https://check.zevyg.icu/gkcxv.google
- file: 154.39.0.198
- hash: 2404
- url: https://qu.ap.4t.com/
- domain: qu.ap.4t.com
- domain: eventvegetable.cfd
- url: https://astroset.top/glasojz
- url: https://ffurthert.run/azpp
- url: http://61.54.253.90:35217/mozi.m
- url: http://61.53.150.175:46959/mozi.m
- domain: check.vuces.icu
- url: https://check.vuces.icu/gkcxv.google
- file: 123.249.34.118
- hash: 80
- file: 101.126.132.211
- hash: 8080
- file: 45.128.52.153
- hash: 9001
- file: 156.245.27.211
- hash: 4444
- url: https://jzestmodp.top/zeda
- url: https://u1.entouragescuff.shop/s0si8s0ryw.aac
- file: 185.39.19.50
- hash: 429
- domain: check.dymyf.icu
- url: https://check.dymyf.icu/gkcxv.google
- file: 185.236.231.64
- hash: 2404
- file: 108.171.194.157
- hash: 2404
- file: 96.9.124.72
- hash: 443
- file: 150.109.109.4
- hash: 8089
- file: 77.105.161.131
- hash: 8089
- file: 181.162.149.118
- hash: 8080
- domain: mu1.cows-make.mooo.com
- file: 196.251.71.29
- hash: 41277
- file: 64.176.220.177
- hash: 1433
- file: 156.110.49.73
- hash: 8080
- file: 39.40.175.175
- hash: 995
- file: 72.203.219.254
- hash: 443
- file: 154.90.37.1
- hash: 443
- file: 213.157.243.59
- hash: 443
- file: 213.157.243.63
- hash: 443
- domain: check.cuxor.icu
- url: https://check.cuxor.icu/gkcxv.google
- domain: check.mujan.icu
- url: https://check.mujan.icu/gkcxv.google
- url: https://ixcelmodo.run/nahd
- url: https://yclarmodq.top/qoxo
- url: https://u1.quenchunpaired.shop/j4vs9gkur6.aac
- domain: u1.quenchunpaired.shop
- url: https://quickbooks.intuit.com/cas/dam/document/a2uowjft5/pdf-invoice.pdf?id=46am7cknhfc
- url: https://www.wearerescue.com/wp-content/plugins/resads/mfls.php?id=qwspuwlh23twhnr6fmpi
- domain: check.guqev.icu
- url: https://check.guqev.icu/gkcxv.google
- domain: check.wetad.icu
- url: https://check.wetad.icu/gkcxv.google
- url: https://u1.quenchunpaired.shop/0zrh4rz6vs.aac
- url: https://u1.quenchunpaired.shop/bmbh68dhvi.aac
- domain: check.wolum.icu
- url: https://check.wolum.icu/gkcxv.google
- file: 45.91.8.171
- hash: 443
- file: 62.109.28.14
- hash: 11012
- file: 83.229.125.122
- hash: 80
- file: 109.117.210.68
- hash: 88
- file: 196.251.71.150
- hash: 2404
- file: 176.65.141.184
- hash: 6606
- file: 89.23.108.20
- hash: 7443
- file: 52.220.3.228
- hash: 80
- file: 49.12.206.241
- hash: 6000
- file: 4.236.160.76
- hash: 80
- file: 139.84.241.157
- hash: 443
- domain: cdn.st4b4n.fr
- file: 15.156.207.217
- hash: 20546
- file: 35.179.164.167
- hash: 30709
- domain: net-5-95-41-119.cust.vodafonedsl.it
- domain: check.mopoj.icu
- url: https://check.mopoj.icu/gkcxv.google
- file: 30.171.16.36
- hash: 443
- domain: cpanel.gemstonebookkeepingservices.com
- url: https://check.bugyx.icu/gkcxv.google
- domain: check.bugyx.icu
- url: https://5easyupgw.live/eosz
- url: https://minstrelwpay.digital/gudd
- url: https://pssoursopsf.run/gsoiao
- url: https://tangledxwood.digital/gpep
- url: https://wvqaliantheart.live/oniz
- url: https://waxworkx.com/4e7u.js
- domain: waxworkx.com
- url: https://waxworkx.com/js.php
- url: https://7zestmodp.top/zeda
- url: https://enhancrea.digital/opzs
- url: https://6liftally.top/xasj
- url: https://qzestmodp.top/zeda
- url: https://txcelmodo.run/nahd
- url: https://vqaliantheart.live/oniz
- url: https://weasyupgw.live/eosz
- url: https://8upmodini.digital/gokk
- url: https://gchangeaie.top/geps
- url: https://highcouncipl.live/sooz
- url: https://xeasyupgw.live/eosz
- url: https://osalaccgfa.top/gsooz
- url: http://twart.myfirewall.org:9792
- url: http://wqo9.firewall-gateway.de:9792
- url: http://code1.ydns.eu:5287
- url: http://wqo9.firewall-gateway.de:8841
- url: http://rency.ydns.eu:5287
- domain: enhancrea.digital
- domain: check.xufam.icu
- url: https://check.xufam.icu/gkcxv.google
- domain: h1.mockupeastcoast.shop
- domain: vqaliantheart.live
- file: 8.152.194.88
- hash: 7443
- file: 24.152.38.198
- hash: 2404
- file: 196.251.73.130
- hash: 2404
- file: 172.111.131.46
- hash: 46167
- file: 172.93.218.191
- hash: 2404
- file: 5.181.157.69
- hash: 55555
- file: 196.251.72.54
- hash: 2404
- url: https://izone.digital/lime/loop.js
- domain: izone.digital
- url: https://izone.digital/lime/index.php
- url: https://izone.digital/lime/vid.php
- file: 82.66.202.142
- hash: 8808
- url: https://krediteonlinevergleichen.top/lime/woot.zip
- domain: krediteonlinevergleichen.top
- file: 85.10.140.75
- hash: 8843
- file: 172.190.116.65
- hash: 80
- file: 20.124.86.1
- hash: 443
- file: 20.121.51.90
- hash: 443
- file: 202.95.14.159
- hash: 443
- file: 3.96.218.163
- hash: 20546
- file: 194.180.191.189
- hash: 443
- file: 109.172.92.205
- hash: 443
- file: 45.76.160.245
- hash: 8008
- domain: mail-exchange.phermera.ru
- domain: check.bugix.icu
- file: 206.81.21.87
- hash: 53
- url: https://check.bugix.icu/gkcxv.google
- url: https://check.xiwaj.icu/gkcxv.google
- file: 46.109.38.223
- hash: 8808
- file: 144.172.89.56
- hash: 80
- file: 189.46.38.89
- hash: 5000
- file: 172.86.75.168
- hash: 443
- file: 152.42.218.167
- hash: 8443
- file: 4.236.186.94
- hash: 80
- file: 4.236.186.94
- hash: 443
- file: 20.124.80.116
- hash: 443
- file: 4.236.160.76
- hash: 443
- file: 196.251.73.5
- hash: 7070
- file: 92.255.85.207
- hash: 1414
- file: 52.193.158.188
- hash: 80
- url: https://check.favop.icu/gkcxv.google
- file: 113.207.40.42
- hash: 4506
- file: 130.43.6.250
- hash: 995
- file: 189.140.26.132
- hash: 443
- file: 194.55.137.13
- hash: 443
- file: 219.229.81.200
- hash: 8860
- file: 45.153.189.245
- hash: 443
- file: 8.130.24.206
- hash: 8080
- file: 96.19.149.127
- hash: 443
- url: https://check.huquw.icu/gkcxv.google
- url: https://aquesolp.run/agosoz
- url: https://beowlflright.digital/qopy
- url: https://jawdedmirror.run/ewqd
- url: https://lonfgshadow.live/xawi
- url: https://nighetwhisper.top/lekd
- url: https://owlflright.digital/qopy
- url: https://v0nighetwhisper.top/lekd
- url: https://waquesolp.run/agosoz
- url: https://ieasyupgw.live/eosz
- url: https://yeasyupgw.live/eosz
ThreatFox IOCs for 2025-04-11
Medium
Published: Fri Apr 11 2025 (04/11/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2025-04-11
AI-Powered Analysis
AILast updated: 06/19/2025, 16:03:51 UTC
Technical Analysis
The provided threat information pertains to a malware-related intelligence report titled "ThreatFox IOCs for 2025-04-11," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The report is categorized under "type:osint," indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. There are no affected product versions listed, and no specific Common Weakness Enumerations (CWEs) or patch links are provided, suggesting that this report serves as a collection or update of IOCs rather than detailing a new vulnerability or exploit. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, which may imply moderate threat presence and distribution but limited analysis depth. Notably, there are no known exploits in the wild associated with this threat at the time of publication, and no indicators are explicitly listed in the provided data. The absence of detailed technical indicators or exploit information limits the ability to assess the malware's behavior, infection vectors, or payload specifics. Overall, this report appears to be a routine update of threat intelligence data rather than an alert about an active or emerging critical threat.
Potential Impact
Given the limited technical details and absence of known exploits in the wild, the immediate impact on European organizations is likely to be low to medium. Since the threat is categorized under OSINT and lacks specific affected products or vulnerabilities, it may primarily serve as background intelligence that could inform defensive measures rather than representing an active attack vector. However, organizations relying heavily on open-source threat intelligence feeds or those involved in cybersecurity operations might find value in integrating these IOCs to enhance detection capabilities. The potential impact on confidentiality, integrity, or availability is minimal without evidence of active exploitation or targeted attacks. Nonetheless, the distribution rating suggests some level of propagation or sharing of this intelligence, which could precede or accompany more significant threats. European organizations in sectors with high exposure to malware threats, such as finance, critical infrastructure, or government, should remain vigilant but are not currently at elevated risk from this specific report.
Mitigation Recommendations
1. Integrate the provided IOCs from ThreatFox into existing Security Information and Event Management (SIEM) and endpoint detection and response (EDR) tools to enhance detection capabilities, even if no active exploits are currently known. 2. Maintain up-to-date threat intelligence feeds and ensure that security teams regularly review and correlate OSINT data with internal logs to identify potential early indicators of compromise. 3. Conduct regular training for security analysts on interpreting and operationalizing OSINT-derived IOCs to improve response times and accuracy. 4. Implement network segmentation and strict access controls to limit potential malware spread should any related threats emerge. 5. Continuously monitor for updates from ThreatFox and other reputable sources to quickly adapt defenses if new exploit information or active campaigns are reported. 6. Avoid reliance solely on automated ingestion of OSINT data; incorporate human analysis to validate the relevance and accuracy of IOCs before operational use.
Affected Countries
Need more detailed analysis?Get Pro
Pro Feature
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- 45dd83ed-014f-4fff-846a-40d62d27778f
- Original Timestamp
- 1744416187
Indicators of Compromise
File
| Value | Description | Copy |
|---|---|---|
file192.169.69.26 | NjRAT botnet C2 server (confidence level: 75%) | |
file147.185.221.19 | NjRAT botnet C2 server (confidence level: 75%) | |
file139.45.197.252 | SpyNote botnet C2 server (confidence level: 100%) | |
file139.45.197.252 | SpyNote payload delivery server (confidence level: 50%) | |
file147.185.221.27 | NjRAT botnet C2 server (confidence level: 75%) | |
file176.65.141.245 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file185.196.11.208 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file14.103.131.223 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file196.251.116.165 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file38.69.8.179 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file38.69.8.179 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file128.90.106.149 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file78.164.223.72 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file144.172.89.56 | Hook botnet C2 server (confidence level: 100%) | |
file23.146.40.48 | Kaiji botnet C2 server (confidence level: 100%) | |
file167.99.42.160 | Unknown malware botnet C2 server (confidence level: 100%) | |
file64.176.220.177 | BianLian botnet C2 server (confidence level: 100%) | |
file87.121.84.211 | Mirai botnet C2 server (confidence level: 75%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.51 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.51 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file165.154.112.217 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file102.117.170.21 | Unknown malware botnet C2 server (confidence level: 100%) | |
file77.105.161.131 | Hook botnet C2 server (confidence level: 100%) | |
file209.38.23.41 | Havoc botnet C2 server (confidence level: 100%) | |
file103.45.68.160 | Kaiji botnet C2 server (confidence level: 100%) | |
file38.147.187.21 | Unknown malware botnet C2 server (confidence level: 100%) | |
file192.159.99.119 | Remcos botnet C2 server (confidence level: 100%) | |
file43.255.159.28 | Unknown malware botnet C2 server (confidence level: 100%) | |
file23.95.168.170 | Unknown malware botnet C2 server (confidence level: 100%) | |
file34.51.128.91 | Unknown malware botnet C2 server (confidence level: 100%) | |
file35.83.81.194 | Unknown malware botnet C2 server (confidence level: 100%) | |
file82.115.223.2 | Unknown malware botnet C2 server (confidence level: 100%) | |
file54.153.134.100 | Unknown malware botnet C2 server (confidence level: 100%) | |
file54.245.193.7 | Unknown malware botnet C2 server (confidence level: 100%) | |
file139.196.24.58 | Unknown malware botnet C2 server (confidence level: 100%) | |
file35.184.140.77 | Unknown malware botnet C2 server (confidence level: 100%) | |
file16.171.171.2 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.255.204.251 | Unknown malware botnet C2 server (confidence level: 100%) | |
file101.108.135.165 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file108.181.155.15 | Chaos botnet C2 server (confidence level: 100%) | |
file108.181.155.15 | Chaos botnet C2 server (confidence level: 100%) | |
file154.39.0.198 | Remcos botnet C2 server (confidence level: 75%) | |
file123.249.34.118 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file101.126.132.211 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file45.128.52.153 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file156.245.27.211 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file185.39.19.50 | Tofsee botnet C2 server (confidence level: 100%) | |
file185.236.231.64 | Remcos botnet C2 server (confidence level: 100%) | |
file108.171.194.157 | Remcos botnet C2 server (confidence level: 100%) | |
file96.9.124.72 | Remcos botnet C2 server (confidence level: 100%) | |
file150.109.109.4 | Hook botnet C2 server (confidence level: 100%) | |
file77.105.161.131 | Hook botnet C2 server (confidence level: 100%) | |
file181.162.149.118 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file196.251.71.29 | MooBot botnet C2 server (confidence level: 100%) | |
file64.176.220.177 | BianLian botnet C2 server (confidence level: 100%) | |
file156.110.49.73 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file39.40.175.175 | QakBot botnet C2 server (confidence level: 75%) | |
file72.203.219.254 | QakBot botnet C2 server (confidence level: 75%) | |
file154.90.37.1 | Meterpreter botnet C2 server (confidence level: 75%) | |
file213.157.243.59 | Meterpreter botnet C2 server (confidence level: 75%) | |
file213.157.243.63 | Meterpreter botnet C2 server (confidence level: 75%) | |
file45.91.8.171 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
file62.109.28.14 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file83.229.125.122 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file109.117.210.68 | DarkComet botnet C2 server (confidence level: 100%) | |
file196.251.71.150 | Remcos botnet C2 server (confidence level: 100%) | |
file176.65.141.184 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file89.23.108.20 | Unknown malware botnet C2 server (confidence level: 100%) | |
file52.220.3.228 | Hook botnet C2 server (confidence level: 100%) | |
file49.12.206.241 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file4.236.160.76 | Havoc botnet C2 server (confidence level: 100%) | |
file139.84.241.157 | Havoc botnet C2 server (confidence level: 100%) | |
file15.156.207.217 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file35.179.164.167 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file30.171.16.36 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file8.152.194.88 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file24.152.38.198 | Remcos botnet C2 server (confidence level: 100%) | |
file196.251.73.130 | Remcos botnet C2 server (confidence level: 100%) | |
file172.111.131.46 | Remcos botnet C2 server (confidence level: 100%) | |
file172.93.218.191 | Remcos botnet C2 server (confidence level: 100%) | |
file5.181.157.69 | Remcos botnet C2 server (confidence level: 100%) | |
file196.251.72.54 | Remcos botnet C2 server (confidence level: 100%) | |
file82.66.202.142 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file85.10.140.75 | Havoc botnet C2 server (confidence level: 100%) | |
file172.190.116.65 | Havoc botnet C2 server (confidence level: 100%) | |
file20.124.86.1 | Havoc botnet C2 server (confidence level: 100%) | |
file20.121.51.90 | Havoc botnet C2 server (confidence level: 100%) | |
file202.95.14.159 | DCRat botnet C2 server (confidence level: 100%) | |
file3.96.218.163 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file194.180.191.189 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file109.172.92.205 | QakBot botnet C2 server (confidence level: 75%) | |
file45.76.160.245 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file206.81.21.87 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file46.109.38.223 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file144.172.89.56 | Hook botnet C2 server (confidence level: 100%) | |
file189.46.38.89 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file172.86.75.168 | Havoc botnet C2 server (confidence level: 100%) | |
file152.42.218.167 | Havoc botnet C2 server (confidence level: 100%) | |
file4.236.186.94 | Havoc botnet C2 server (confidence level: 100%) | |
file4.236.186.94 | Havoc botnet C2 server (confidence level: 100%) | |
file20.124.80.116 | Havoc botnet C2 server (confidence level: 100%) | |
file4.236.160.76 | Havoc botnet C2 server (confidence level: 100%) | |
file196.251.73.5 | Venom RAT botnet C2 server (confidence level: 100%) | |
file92.255.85.207 | DCRat botnet C2 server (confidence level: 100%) | |
file52.193.158.188 | Brute Ratel C4 botnet C2 server (confidence level: 100%) | |
file113.207.40.42 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file130.43.6.250 | QakBot botnet C2 server (confidence level: 75%) | |
file189.140.26.132 | QakBot botnet C2 server (confidence level: 75%) | |
file194.55.137.13 | Eye Pyramid botnet C2 server (confidence level: 75%) | |
file219.229.81.200 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file45.153.189.245 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file8.130.24.206 | Havoc botnet C2 server (confidence level: 75%) | |
file96.19.149.127 | QakBot botnet C2 server (confidence level: 75%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash1605 | NjRAT botnet C2 server (confidence level: 75%) | |
hash6863 | NjRAT botnet C2 server (confidence level: 75%) | |
hash443 | SpyNote botnet C2 server (confidence level: 100%) | |
hash443 | SpyNote payload delivery server (confidence level: 50%) | |
hash19766 | NjRAT botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash443 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8082 | Hook botnet C2 server (confidence level: 100%) | |
hash2095 | Kaiji botnet C2 server (confidence level: 100%) | |
hash4000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | BianLian botnet C2 server (confidence level: 100%) | |
hash8080 | Mirai botnet C2 server (confidence level: 75%) | |
hash424 | Tofsee botnet C2 server (confidence level: 100%) | |
hash431 | Tofsee botnet C2 server (confidence level: 100%) | |
hash417 | Tofsee botnet C2 server (confidence level: 100%) | |
hash416 | Tofsee botnet C2 server (confidence level: 100%) | |
hash428 | Tofsee botnet C2 server (confidence level: 100%) | |
hash421 | Tofsee botnet C2 server (confidence level: 100%) | |
hash429 | Tofsee botnet C2 server (confidence level: 100%) | |
hash418 | Tofsee botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Hook botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash808 | Kaiji botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash1000 | Remcos botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3335 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7878 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7443 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash80 | Chaos botnet C2 server (confidence level: 100%) | |
hash8080 | Chaos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash4444 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash429 | Tofsee botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Remcos botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash8080 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash41277 | MooBot botnet C2 server (confidence level: 100%) | |
hash1433 | BianLian botnet C2 server (confidence level: 100%) | |
hash8080 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash443 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash443 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash443 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
hash11012 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash88 | DarkComet botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Hook botnet C2 server (confidence level: 100%) | |
hash6000 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash80 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash20546 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash30709 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash7443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash46167 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash55555 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8843 | Havoc botnet C2 server (confidence level: 100%) | |
hash80 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | DCRat botnet C2 server (confidence level: 100%) | |
hash20546 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash8008 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash53 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | Hook botnet C2 server (confidence level: 100%) | |
hash5000 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash8443 | Havoc botnet C2 server (confidence level: 100%) | |
hash80 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash7070 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash1414 | DCRat botnet C2 server (confidence level: 100%) | |
hash80 | Brute Ratel C4 botnet C2 server (confidence level: 100%) | |
hash4506 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | Eye Pyramid botnet C2 server (confidence level: 75%) | |
hash8860 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash8080 | Havoc botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) |
Domain
| Value | Description | Copy |
|---|---|---|
domainpack-amber.gl.at.ply.gg | NjRAT botnet C2 domain (confidence level: 75%) | |
domainpdel.tsyndicate.com | SpyNote botnet C2 domain (confidence level: 50%) | |
domainpsub.tsyndicate.com | SpyNote botnet C2 domain (confidence level: 50%) | |
domainpdel.tsyndicate.com | SpyNote payload delivery domain (confidence level: 75%) | |
domainpsub.tsyndicate.com | SpyNote payload delivery domain (confidence level: 75%) | |
domainget-met.gl.at.ply.gg | NjRAT botnet C2 domain (confidence level: 75%) | |
domainlummamarket.com | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainlumc2-market.fun | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domaincpcalendars.aaa.104-168-101-27.cprapid.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domaincheck.xiwuc.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpcalendars.c.multi-canale.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainu1.entouragescuff.shop | Lumma Stealer payload delivery domain (confidence level: 100%) | |
domaind1.dyfot.fun | Lumma Stealer payload delivery domain (confidence level: 100%) | |
domaincheck.zevyg.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainqu.ap.4t.com | Vidar botnet C2 domain (confidence level: 100%) | |
domaineventvegetable.cfd | Unknown Loader botnet C2 domain (confidence level: 100%) | |
domaincheck.vuces.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.dymyf.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainmu1.cows-make.mooo.com | Havoc botnet C2 domain (confidence level: 100%) | |
domaincheck.cuxor.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.mujan.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainu1.quenchunpaired.shop | Lumma Stealer payload delivery domain (confidence level: 100%) | |
domaincheck.guqev.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.wetad.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincheck.wolum.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincdn.st4b4n.fr | Havoc botnet C2 domain (confidence level: 100%) | |
domainnet-5-95-41-119.cust.vodafonedsl.it | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaincheck.mopoj.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domaincpanel.gemstonebookkeepingservices.com | FAKEUPDATES botnet C2 domain (confidence level: 100%) | |
domaincheck.bugyx.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainwaxworkx.com | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domainenhancrea.digital | Lumma Stealer botnet C2 domain (confidence level: 50%) | |
domaincheck.xufam.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainh1.mockupeastcoast.shop | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainvqaliantheart.live | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainizone.digital | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domainkrediteonlinevergleichen.top | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domainmail-exchange.phermera.ru | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domaincheck.bugix.icu | ClearFake payload delivery domain (confidence level: 100%) |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://check.xiwuc.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttp://61.3.137.100:44479/mozi.m | Mozi payload delivery URL (confidence level: 50%) | |
urlhttp://14.102.189.30:58105/mozi.m | Mozi payload delivery URL (confidence level: 50%) | |
urlhttps://modproz.run/opqz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://u1.entouragescuff.shop/35bf3fcr80.aac | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://d1.dyfot.fun/d6d0c07fe5ee8c61f23e1cf95c5035fc | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://check.zevyg.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://qu.ap.4t.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://astroset.top/glasojz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://ffurthert.run/azpp | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://61.54.253.90:35217/mozi.m | Mozi payload delivery URL (confidence level: 50%) | |
urlhttp://61.53.150.175:46959/mozi.m | Mozi payload delivery URL (confidence level: 50%) | |
urlhttps://check.vuces.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://jzestmodp.top/zeda | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://u1.entouragescuff.shop/s0si8s0ryw.aac | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://check.dymyf.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.cuxor.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.mujan.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://ixcelmodo.run/nahd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://yclarmodq.top/qoxo | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://u1.quenchunpaired.shop/j4vs9gkur6.aac | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://quickbooks.intuit.com/cas/dam/document/a2uowjft5/pdf-invoice.pdf?id=46am7cknhfc | Latrodectus payload delivery URL (confidence level: 95%) | |
urlhttps://www.wearerescue.com/wp-content/plugins/resads/mfls.php?id=qwspuwlh23twhnr6fmpi | Latrodectus payload delivery URL (confidence level: 95%) | |
urlhttps://check.guqev.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.wetad.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://u1.quenchunpaired.shop/0zrh4rz6vs.aac | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://u1.quenchunpaired.shop/bmbh68dhvi.aac | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://check.wolum.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.mopoj.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.bugyx.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://5easyupgw.live/eosz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://minstrelwpay.digital/gudd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://pssoursopsf.run/gsoiao | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://tangledxwood.digital/gpep | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://wvqaliantheart.live/oniz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://waxworkx.com/4e7u.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://waxworkx.com/js.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://7zestmodp.top/zeda | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://enhancrea.digital/opzs | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://6liftally.top/xasj | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://qzestmodp.top/zeda | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://txcelmodo.run/nahd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://vqaliantheart.live/oniz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://weasyupgw.live/eosz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://8upmodini.digital/gokk | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://gchangeaie.top/geps | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://highcouncipl.live/sooz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://xeasyupgw.live/eosz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://osalaccgfa.top/gsooz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://twart.myfirewall.org:9792 | Quasar RAT botnet C2 (confidence level: 50%) | |
urlhttp://wqo9.firewall-gateway.de:9792 | Quasar RAT botnet C2 (confidence level: 50%) | |
urlhttp://code1.ydns.eu:5287 | Quasar RAT botnet C2 (confidence level: 50%) | |
urlhttp://wqo9.firewall-gateway.de:8841 | Quasar RAT botnet C2 (confidence level: 50%) | |
urlhttp://rency.ydns.eu:5287 | Quasar RAT botnet C2 (confidence level: 50%) | |
urlhttps://check.xufam.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://izone.digital/lime/loop.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://izone.digital/lime/index.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://izone.digital/lime/vid.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://krediteonlinevergleichen.top/lime/woot.zip | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://check.bugix.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.xiwaj.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.favop.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://check.huquw.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://aquesolp.run/agosoz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://beowlflright.digital/qopy | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://jawdedmirror.run/ewqd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://lonfgshadow.live/xawi | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://nighetwhisper.top/lekd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://owlflright.digital/qopy | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://v0nighetwhisper.top/lekd | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://waquesolp.run/agosoz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://ieasyupgw.live/eosz | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://yeasyupgw.live/eosz | Lumma Stealer botnet C2 (confidence level: 75%) |
Threat ID: 682c7db4e8347ec82d2adc6a
Added to database: 5/20/2025, 1:03:48 PM
Last enriched: 6/19/2025, 4:03:51 PM
Last updated: 7/28/2025, 7:02:22 PM
Views: 9
Related Threats
A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode
MediumMalwareThu Aug 14 2025
PhantomCard: New NFC-driven Android malware emerging in Brazil
MediumMalwareThu Aug 14 2025
ThreatFox IOCs for 2025-08-13
MediumMalwareThu Aug 14 2025
Efimer Trojan Steals Crypto, Hacks WordPress Sites via Torrents and Phishing
MediumMalwareWed Aug 13 2025
Silent Watcher: Dissecting Cmimai Stealer's VBS Payload
MediumMalwareWed Aug 13 2025
Actions
PRO
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Please log in to the Console to use AI analysis features.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.