Skip to main content

DeerStealer

Malware Family

117 indicators of compromise attributed to DeerStealer across abuse.ch threat intelligence feeds.

Domains

24

IPs

1

URLs

3

Hashes

89

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
divaselinsajep.comdomain
merengagoi.bonddomain
gooddogshop.clickdomain
infospi.pldomain
krempie.xyzdomain
mymicroblog.latdomain
antongandon.clubdomain
productionmaza.cfddomain
mybiggestjoy.bonddomain
denegnet.clickdomain
productionmaza.cyoudomain
blatnoitovar.xyzdomain
bestwebchlen.cyoudomain
beacon-mysummitfcu.orgdomain
allplanetssame.cfddomain
microblob.bonddomain
quebecsereinhalcyon.comdomain
ljubanawaterburythody.comdomain
solstice-line-drift.prodomain
brasserieontarioaube.comdomain
149.33.8.86ip
https://royalindiancurryclub.com/files/AUHAVKIQ.msiurl
https://floridacambolashop.com/fc3411f3-e43a-51ab-a00d-f6cd430fa334/stock4url
http://quebecsereinhalcyon.com/curl
c3475b38aed6514ce6ccbeb9df8393d3a9031421c3ebbb2270aaaf776d05d7c4hash
15f0afab127b657e6c3d2390d867b7a610acee6902fd097c1f28dcf77449fad1hash
e5929c73939fb69820a63bdc6e2a3014a405815840ec5b346fbf0ccb9ffc4fa9hash
562bb0195ecd7959c535a5f2cce92125296d4921a15b5339f2f68ba815a7101bhash
387c0b928b4211897c14214aa84cfcb8203a4724a120db336748f1752c4068a4hash
8b4a40d5bf036b2193ffe08ec01f8d5e5eebbd63ba793bea714965ba216362ffhash
bfe06b2f18cdbc4d74b731a2fe52f66d3e4da9f9f0bbf9730b816b5418e5f12bhash
f5d54923c88c02c07fdcfd9af1d99440faf7ea6fb3744f2d4cdcf5898b504eb8hash
82a6ebc4ce6cc397cbcc8c7002901a83a2568beec4fa88e279a5f0512fdf5085hash
9de72bbf7efdb9b528351ec7ad706d6197e860a78b2846adf700cbc10d0760fahash
9f3d4df2d4ae2c25cb35ac2c06fbb211b8edc270fdc70074355ca7bd3c61a202hash
00529b4e3afb5a796a2cfc0d6038f5d571c2acfb81ddf13b209c8ae0f607399ehash
7b6a20d4e79537be320147d55123f2f40389e6445fdb9d2bd798596630e5f5f8hash
d55555fd3b85cd9489edabc761e17ef366b37d7d4d722f174e644c872d85a459hash
58b80c51e15d7671911e897767d011c2160c526a328b71d418b09d2c5cfb5886hash
70a1c2bc6c70934cd9359c40bb89ea394e233f091753dbbc7ce8791af4d45ed8hash
eb085b0601e7d719c62a4d9ae994beaeff15493936dbb23476b30275f3be088chash
71149e56febb1f0b96518016f33dcfae141c8d8e1dcca5de5b97519214ec6de5hash
b77625cae72301aa6736c543f1c9d80fhash
0da7be1647f31711fd16932c46c9897f5d5d321746d4e8ff0f5184c59d08cbe4hash

Another file to check? Run a file hash reputation check.