s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932773 high

📛 Threat Title

Stealc: URL that is used for botnet Command&control (C&C) http://13.143.165.81/

Category: Stealc Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Stealc. Confidence: 100. First seen: 2026-09-25 11:47:17 UTC. Last seen: 2026-09-25 12:00:27 UTC. Reporter: Bitsight. Tags: c2, Loader, New, Stealc, stealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url http://13.143.165.81/

IOC database

Type
url
Value
http://13.143.165.81/
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that is used for botnet Command&control (C&C) attributed to Stealc

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Stealc. Confidence: 100. First seen: 2026-09-25 11:47:17 UTC. Last seen: 2026-09-25 12:00:27 UTC. Reporter: Bitsight. Tags: c2, Loader, New, Stealc, stealer.

Remediations (10)

  • Researchers Gain Access to StealC Malware Command-and-Control Systems
    web:cybersecuritynews.com

    Security researchers successfully exploited vulnerabilities in the StealC malware infrastructure, gaining access to operator control panels and exposing a threat actor's identity through their own stolen session cookies.

  • Feodo Tracker | Blocklist - abuse.ch
    web:feodotracker.abuse.ch

    Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting. Feodo Tracker offers a blocklist of IP addresses that are associated with such botnet C2s. It can be used to ...

  • Feodo Tracker | Browse Botnet C&Cs
    web:feodotracker.abuse.ch

    Here you can browse the list of botnet Command&Control servers ( C&Cs ) tracked by Feodo Tracker, associated with Dridex, TrickBot, QakBot (aka QuakBot/Qbot), BazarLoader (aka BazarBackdoor) and Emotet (aka Heodo). When Feodo Tracker was launched in 2010, it was meant to track Feodo botnet C&Cs .

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • StealC and Amadey: Breaking down infostealers and the cybercrime ...
    web:www.microsoft.com

    On June 24, 2026, Microsoft's Digital Crimes Unit (DCU), working with Europol and industry partners, announced a coordinated disruption action resulting in the takedown, suspension, and blocking of domains and command-and-control (C2) servers that formed the backbone of StealC and Amadey infrastructure.

  • StealC v2 Malware Enhances Stealth and Expands Data Theft Features
    web:www.picussecurity.com

    StealC v2 communicates with its command-and-control (C2) server over HTTP , using Base64-encoded JSON messages. Although the malware's developer claimed support for RC4 encryption in later builds, analysis of version 2 samples shows that RC4 is typically disabled, leaving communication in unencrypted Base64 format.

  • StealC Historical Bot Infection Special Report
    web:www.shadowserver.org

    New StealC Historical Bot Infections Special Report As part of this disruption operation, overnight (2026-06-24) we ran a new one-off StealC Historical Bot Infection Special Report.

  • Live botnet threats worldwide | Spamhaus Technology
    web:www.spamhaus.com

    Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • Botnet C&C | Botnet Threat Update January to June 2026 | Report
    web:www.spamhaus.org

    Botnet Threat Update January to June 2026 Between Jan-Jun 2026 botnet C&C servers observed decreased -30% to 14,952. Sliver overtook Cobalt Strike for the #1 spot (+58%). Meanwhile .cn botnet C&C domains surged +771% and India's PDR registrar saw a +901% spike in abused registrations - though REGRU bucked the trend with a -90% reduction. Read the latest report to learn more.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.