🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain app.app-river.icu.

Database Entry


IOC ID:1974920
IOC: app.app-river.icu
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-10-20 05:12:58 UTC
Last seen:never
UUID:ca3887a3-cc2f-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:etherhiding freight-lure panel RAT

Avatar
Darkfibr
Panel/C2 hosts of the freight-themed Node.js remote-access trojan campaign. The panel is a bespoke 'Remote Support Console' (system-key + system-token operator login) served from these hosts; proven by a urlscan title+bundle-hash cluster and OTX HTTP scans, not by contacting the hosts. foundation.forum is also the loader's DNS discovery anchor (_relay._discovery.foundation.forum). The BSC dead-drop contract 0xCc4BCd51e0eA7E254b0F30044538F6Cb86a4E61b returned a 7-URL list including api.xyz-code.biz, app.app-river.icu, check.okx3.io and the nffnj workers on 2026-10-20T02:03Z. Static/passive analysis only.