s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1931114 high

📛 Threat Title

Remus: URL that is used for botnet Command&control (C&C) http://phetsre.shop:3452/products

Category: Remus Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-23 23:45:11 UTC. Reporter: Myrtus0x0. Tags: Remus.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url http://phetsre.shop:3452/products UrlVoid 0 / 36

IOC database

Type
url
Value
http://phetsre.shop:3452/products
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that is used for botnet Command&control (C&C) attributed to Remus

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-23 23:45:11 UTC. Reporter: Myrtus0x0. Tags: Remus.

Remediations (10)

  • Remus Stealer Malware Analysis, Overview by ANY.RUN
    web:any.run

    Remus Stealer is a sophisticated 64-bit information stealer operating under a Malware-as-a-Service (MaaS) model. Identified as a direct evolution of the infamous Lumma Stealer, Remus specializes in harvesting credentials, cookies, and cryptocurrency wallets while utilizing blockchain technology for command-and-control (C2) resilience.

  • Feodo Tracker | Browse Botnet C&Cs
    web:feodotracker.abuse.ch

    Here you can browse the list of botnet Command&Control servers ( C&Cs ) tracked by Feodo Tracker, associated with Dridex, TrickBot, QakBot (aka QuakBot/Qbot), BazarLoader (aka BazarBackdoor) and Emotet (aka Heodo). When Feodo Tracker was launched in 2010, it was meant to track Feodo botnet C&Cs .

  • Remus Stealer: A New, Not-So-New Infostealer | Flashpoint
    web:flashpoint.io

    Remus stealer represents a sophisticated continuation of the MaaS infostealer model left behind by Lumma's collapse. While the developer asserts independence, the overwhelming code overlaps, matching obfuscation techniques, and administrative panels indicate that Remus is either heavily inspired by, or derived from the Lumma codebase.

  • Remus Infostealer Uses Ethereum for Dynamic Command and Control
    web:portal.vyprsec.ai

    A new information-stealing malware, Remus , is employing an Ethereum smart contract to dynamically retrieve its command and control server address, making it harder to block.

  • ThreatFox | http://phetsre.shop:3452/posts
    web:threatfox.abuse.ch

    You are viewing the ThreatFox database entry for url http ://phetsre.shop:3452/posts.

  • Botnet C&C (Command and Control) Explained | ITU Online
    web:www.ituonline.com

    The infrastructure through which botnets are controlled and managed by attackers. C&C servers send commands to compromised machines (bots) to execute malicious activities. A botnet C&C (Command and Control) is the infrastructure that allows cybercriminals to manage and control a network of compromised computers or devices, known as bots.

  • Botnets | Malwarebytes Labs
    web:www.malwarebytes.com

    Botnets are networks of computers infected by a botnet agent that are under hidden control of a third party. They are used to execute various commands ordered by the attacker. Most common uses of botnets are criminal operations that require distributed resources, such as DDoS attacks on selected targets, spam campaigns, and performing click fraud.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • Botnet C&C | Botnet Threat Update July to December 2025 | Report
    web:www.spamhaus.org

    Botnet Threat Update July to December 2025 Botnet Command & Controller (C&C) activity increased 24% this period, with Remote Access Trojans (RATs) accounting for 42% of the Top 20 malware associated with botnets .

  • Remus Malware Is Hiding Its Control Server Inside Ethereum
    web:www.thespacelab.tv

    How Remus Malware Uses Ethereum for Command and Control Instead of keeping one control-server address inside the malware, Remus asks a hardcoded Ethereum smart contract where to connect. The contract returns encoded server information, which the malware decodes before sending stolen data over ordinary web traffic.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.