Skip to main content

MaskGramStealer

Malware Family

280 indicators of compromise attributed to MaskGramStealer across abuse.ch threat intelligence feeds.

Domains

8

IPs

0

URLs

18

Hashes

254

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
proxymonster.saledomain
zauber-edgecb61leise.icudomain
samtpfotchensnezhok9566leisegepard.sbsdomain
geschmeidig6307-kotyatanet.sbsdomain
ws.geschmeidig6307-kotyatanet.sbsdomain
hongkongplazaworks.topdomain
ryzhikpix6956sanft.cfddomain
kirk-service.livedomain
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/m3o1azkhufs1enkurl
https://ms.com-audio.cloud/files/url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/q7cherolivolejkurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ufcx6bc1ef45e7gurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/a7k56jotufo5ab4url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ujgti3g12f45y74url
https://gist.githubusercontent.com/HexReaper/eec6869214d2b4e12bd606529128f8c2/raw/gistfile1.txturl
https://hydrax.live/download/HydraCheat.7.5.1.zipurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/6v4de3o1yz0du7kurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/2vk56j8h27whyzgurl
http://kirk-service.live/reconcileurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/iro9a3cp6zsd230url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ejk52zwt2js16rourl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/yzc5yj81yv0h2fwurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/y74habwtyvsxarwurl
http://83.217.208.72:6062/url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/mzcxijwx2zg9e7wurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/6v0tazc5mboxujsurl
53e8715272957c3c72d079088691bc6149dbdabc7b923bcd41b13a7edbc6f086hash
2c9cbf61771160a3644e4a4fcbe98dd7hash
e8c73ce5eb660ea6570b5bf5f560eaf994394da02148f7df10aefac1fda8a756hash
03e0b4fd95da1ed152fcb22924c35f05060dd63c89ee5cf751aba498e84a6360hash
6bfcaa9e28fc729f708c03c9f706eec4f268ce6f611be898e3b664e55a8ead7ahash
64e714b6db5a170d195cf7f5ce40a50e0ecf4b59d591fbc4cf282ca37496c952hash
6beeeffd74398fb4435004503348c210c838f3d6f955b7dba54a85e9ae5ceab3hash
e512af88abd3b507426747ba75491f0c0f6798a4e6c717d44cee3de450d09b19hash
2f6efb810bee11eb85bfa3edbdf9015d7d9cf08fc1e44c979a7e6bb21e100108hash
48363812cd10833ff71c8d735e4f7edc6187a6bb66ad7878e32ae9d28a07d37fhash
90b7139ae18d7f529400fcb871a0d411502b5a8d924f7abd3650490286bd241fhash
4b6426609af09c79368ff80f342017e89722353a2998378fbac0fb88af32b3c3hash
090e18571bea63326ed56b61a157f8438f41a299c2dcc11ae5fc94d26418fe0dhash
8224b9c14404d8e8bf74221033466ac4ea33551b92914352be9c0ba92ffbfd43hash
732f29e751c1d2c43eaf1441c75b1203756c94442cf5600c35e56d12d4c7f4fbhash
b51e78b6963fa0b031673a404ba1846dc6037ce179f5fec06f818320ad7ead36hash
38a304ce5196daab20a5d94886c690630628ec22e2d781ab516dcfca32d251b6hash
4543d54f1d174df866bdc815f568852c091edf4d2fa28f61a044cae731d9a875hash
a0286479847a9b004f167b912d00232fda2dea6127227901aa7ad7571345a1c6hash
c39f4a82642778198c30e8f2c06a70df627c558f159ce9fcfff0f5005e8efb0fhash

Another file to check? Run a file hash reputation check.