Skip to main content

Stealc

Malware Family

6 063 indicators of compromise attributed to Stealc across abuse.ch threat intelligence feeds.

Domains

11

IPs

215

URLs

439

Hashes

5 398

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (11)IPs (215)URLs (439)Hashes (5 398)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
windows-update-local.restdomain
cloud-flare-authenticator.linkdomain
cloud-flare-authenticator.clickdomain
svhost-update-service.casadomain
friendihelp.infodomain
api.nailproxy.spacedomain
spellmarketplace.clubdomain
ashpaltlonpro.comdomain
dakatawebstick.comdomain
uehfks.digitaldomain
777palm.comdomain
160.20.109.16ip
209.99.186.230ip
172.94.9.97ip
46.166.165.73ip
77.91.96.222ip
46.151.182.27ip
144.208.127.64ip
2.26.123.18ip
91.92.242.4ip
178.16.54.25ip
144.172.102.43ip
67.217.228.145ip
158.94.209.112ip
138.124.88.111ip
62.60.246.166ip
192.162.199.70ip
91.92.242.231ip
91.92.240.190ip
86.54.25.43ip
160.20.109.90ip
http://87.120.104.81/d19ca32cb5a444ac8b87.phpurl
http://185.215.113.17/2fb6c2cc8dce150a.phpurl
http://83.142.209.192url
https://5.75.232.223/5065bfaf5315fdfb.phpurl
http://213.165.47.49/480bee37986b4097bc20.phpurl
http://193.176.190.41/2fa883eebd632382.phpurl
http://aidandylan.top/3886d2276f6914c4.phpurl
http://185.172.128.23/f993692117a3fda2.phpurl
http://64.89.161.67/3b250ef3f9e542adadfb.phpurl
http://89.46.38.100/c0b30d15260a4d8888dc.phpurl
http://31.76.30.6/url
http://144.31.40.80/url
http://193.148.56.94/url
https://fbdfsgfwrgerwefew.top/url
http://185.215.113.206/e2b1563c6670f193.phpurl
http://176.65.144.73/312b423bf6dd463f8d15.phpurl
http://178.16.55.25/bcbb13c7c8984290857b.phpurl
https://windows-update-local.resturl
https://wirelessat.comurl
http://193.42.32.99url
60d7123cafb385bba287360f90d6f682c6397f8feb030ac0d36f4473b779ab3chash
52dd5ff3704a1d0be979be5a99be19054f5717fe3bc7ff9e7609d211417fb917hash
10183a5473a22d1ddd8fa4e3d196604534581d5bc0fe38349331fc44892b9497hash
10fb11a6893d93eed798777921a2ac2b339395324fcb1af4860daaae1abe5bc7hash
2145497e1ebbe45c2b522074731dafd9e2080413e2245e36e50bc89c26759809hash
2cef6d9917bbccdc5ffffbf7b687da70e673f3a5dc6923c715e4fc50e0115e17hash
851ddab21a1f62c933aee27bbeacb533613cf0d4f3fa6ec8bb92676f0246a329hash
a5863b69f1f7b4cd895754679831f8ee5eef8c41c4c72a9319bd47afcb1d4b22hash
a671b06da890fdc0598db8a9102c51a81dd2b59c3b9e51cd361c7de7a7369040hash

Another file to check? Run a file hash reputation check.