Skip to main content

SantaStealer

Malware Family

253 indicators of compromise attributed to SantaStealer across abuse.ch threat intelligence feeds.

Domains

19

IPs

1

URLs

4

Hashes

229

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
project-info-world.infodomain
newproject-newworld.infodomain
goldspins.clubdomain
iauhgubyag.rudomain
newworld-helloworld.icudomain
world-new-iope.ccdomain
bill-proof.ccdomain
multi-lumpur.comdomain
runniggerniggernigger.rundomain
seall-vernous.comdomain
fuckfuckioaeygiuy.icudomain
corvus-infra.ccdomain
laughing-octo.infodomain
fuckniggerspajeetsandkikes.icudomain
crispy-rusty.comdomain
ou3yrweygtbesw.icudomain
blyatblyatblyatblyatblyat.icudomain
velvet-parrot.comdomain
ruruurururururu.rudomain
178.16.55.36ip
https://goldspins.club/gateurl
https://t.me/gerj_threuhurl
https://corvus-infra.cc/url
https://crispy-rusty.com/url
a7d5ef5a618ec366bfd27c66e42602b24f512d64e562557b2cd762e1284e25aahash
1f6342c481c06364164c910fb8e6f39118beeb2ce59d5df760dca14a2e250abehash
d76aa708f350b4a36453b357b500caf3626eac3a481284792f016f420c05f0b2hash
920c14eda01cf12ea3cc4d22a783f3f93af7143c4e3002d5d8f29af6bec5977ehash
e104807d9f850185a28f59b340ba691acb6aa1a760bd2292ab5612208618d688hash
8100da6f9b544d639eb857d99bf33ceadb31fad65c2e9c33aa8536d77f937230hash
6e18c47a50b490e515f6a10b5078a96c305a33cb4d82e3b7e283e614551d7598hash
a71ede07b162287ea9945348f670e1ede7a972858ee66b924328494c42f9fcc6hash
526ab999fb00cdd92ce229eb945274b15c26acfca62c40d2f5cc6aa259a979d1hash
d5e3d0af0ea15773fb6539d8164c631babe11af7aae7e9ae519ebe2e2fd0d79ehash
6c69eb3ae2ae3831be5b1bba8c7b45f85bab5e07661ffc8b2605c35e4bd0bf9chash
1222fd13b3aa49effa09d0076959ebee85a94bc85e73aa406c86daed6a2d57b6hash
402d2be2a5186e3f8c035551695099c60b28d092969cc72bd9c7360453f8d63ehash
4a3ab120474879218b84e8be86f3243ae0500b6b65ad52f794413e6aafc9ecf5hash
8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679hash
c0c37d4b15adb9b54c63793980fcf5b3d918a10c776150d3597d1a2eae88df75hash
d5f7072f37da49fa1f349a21742b27741642a1f4c5f04ddd733667c94551ee60hash
51fcfcce28187704a91597bd55209971c0f9e2da26ec3e79d48389b56c3b6148hash
a198aedff4f84588326b22aa1ff900f287a3e904f16f172a308c8affe9342f25hash
ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81hash

Another file to check? Run a file hash reputation check.