s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1931099 high

📛 Threat Title

Remus: URL that is used for botnet Command&control (C&C) http://spiohop.shop:9932/images

Category: Remus Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-23 22:58:23 UTC. Reporter: Myrtus0x0. Tags: Remus.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url http://spiohop.shop:9932/images

IOC database

Type
url
Value
http://spiohop.shop:9932/images
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that is used for botnet Command&control (C&C) attributed to Remus

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-23 22:58:23 UTC. Reporter: Myrtus0x0. Tags: Remus.

Remediations (10)

  • Remus Stealer Malware Analysis, Overview by ANY.RUN
    web:any.run

    Remus Stealer is a sophisticated 64-bit information stealer operating under a Malware-as-a-Service (MaaS) model. Identified as a direct evolution of the infamous Lumma Stealer, Remus specializes in harvesting credentials, cookies, and cryptocurrency wallets while utilizing blockchain technology for command-and-control (C2) resilience.

  • Feodo Tracker | Browse Botnet C&Cs
    web:feodotracker.abuse.ch

    Here you can browse the list of botnet Command&Control servers ( C&Cs ) tracked by Feodo Tracker, associated with Dridex, TrickBot, QakBot (aka QuakBot/Qbot), BazarLoader (aka BazarBackdoor) and Emotet (aka Heodo). When Feodo Tracker was launched in 2010, it was meant to track Feodo botnet C&Cs .

  • Remus Stealer: A New, Not-So-New Infostealer | Flashpoint
    web:flashpoint.io

    Remus stealer represents a sophisticated continuation of the MaaS infostealer model left behind by Lumma's collapse. While the developer asserts independence, the overwhelming code overlaps, matching obfuscation techniques, and administrative panels indicate that Remus is either heavily inspired by, or derived from the Lumma codebase.

  • Remus Infostealer Uses Ethereum for Dynamic Command and Control
    web:portal.vyprsec.ai

    A new information-stealing malware, Remus , is employing an Ethereum smart contract to dynamically retrieve its command and control server address, making it harder to block.

  • ThreatFox | http://spiohop.shop:9932/posts
    web:threatfox.abuse.ch

    You are viewing the ThreatFox database entry for url http ://spiohop.shop:9932/posts.

  • ThreatFox | http://spiohop.shop:9932/tasks
    web:threatfox.abuse.ch

    You are viewing the ThreatFox database entry for url http ://spiohop.shop:9932/tasks.

  • How to Defend Against Botnets - GeeksforGeeks
    web:www.geeksforgeeks.org

    At this point, the infected devices are connected and controlled remotely through a central command-and-control (C&C) server. The attacker can command these devices, to perform tasks like sending spam, participating in distributed denial-of-service (DDoS) attacks, or stealing data. How to Prevent Botnet Attacks?

  • The Extended Botnet Controller List is now available via the Spamhaus ...
    web:www.spamhaus.com

    What is the extended Botnet Controller List (eBCL)? This dataset contains single IPv4 addresses used by miscreants to control infected devices, otherwise known as Botnet Command and Controllers, C&Cs , or C2s. At its heart, the eBCL is a "drop all traffic" list detailing the worst of the worse.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • NEW: Spamhaus CERT Insight Portal - Spamhaus Project
    web:www.spamhaus.org

    Introduction What is Spamhaus CERT Insight Portal? Enriched data: Botnet C&C activity in your region Using the portal: Even better functionality How can I access the portal? In 2025, botnet command & controller (C&C) activity detected by Spamhaus increased 56% - a stark reminder that the botnet threat landscape is evolving faster than ever.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.