Remus

Malware Family

1 797 indicators of compromise attributed to Remus across abuse.ch threat intelligence feeds.

Domains

258

IPs

155

URLs

1 383

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Botnet C&CPayload Delivery

Indicator	Type
solidgma.biz	domain
juno-106.com	domain
www.jatka.org	domain
rootsandextracts.com	domain
attorneymarketingannex.com	domain
tolail.xyz	domain
live-matches.xyz	domain
exuviai.cloud	domain
fightwa.biz	domain
easeal.top	domain
www.gilles-hossepied.fr	domain
kereta-tinted.com	domain
effitechltd.com	domain
dikdiy.xyz	domain
marxgo.top	domain
sagaraya.vip	domain
clou-dprotect.co	domain
ayrseu.shop	domain
revvedupnet.com	domain
cafedesamis.it	domain
139.59.42.245	ip
154.19.37.231	ip
185.198.27.174	ip
62.210.127.4	ip
142.132.211.95	ip
62.171.169.111	ip
103.30.145.217	ip
72.60.121.225	ip
103.211.219.238	ip
143.244.130.3	ip
142.132.249.138	ip
104.168.123.242	ip
216.203.20.46	ip
88.222.242.235	ip
45.85.147.53	ip
31.97.61.212	ip
2.56.244.52	ip
2.25.206.107	ip
145.223.93.74	ip
180.188.198.176	ip
http://clouven.click:8527/files	url
http://fgashub.shop:9932/customers	url
http://fuarnpp.shop:5627/subscriptions	url
http://zxdaone.click:6432/subscriptions	url
http://sahalexchange.com:9504	url
http://srtylab.shop:8213/articles	url
http://trencts.shop:8592/notifications	url
http://arqtsop.shop:9932/collections	url
http://srtylab.shop:8213/comments	url
http://teculse.click:9210/folders	url
http://beljaro.shop:2536	url
http://vexdico.shop:8539/orders	url
http://kitwart.click:7892/settings	url
http://flreaow.click:6527/articles	url
http://trencts.shop:8592/payments	url
http://glolsbs.top:5621/addresses	url
http://zakuiru.shop:9048/reviews	url
http://phetsre.shop:3452/users	url
http://alutove.shop:5627/posts	url
http://creesbs.sbs:9932/tags	url

Another file to check? Run a file hash reputation check.