Skip to main content

Unknown Stealer

Malware Family

1 995 indicators of compromise attributed to Unknown Stealer across abuse.ch threat intelligence feeds.

Domains

1 447

IPs

62

URLs

427

Hashes

59

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 447)IPs (62)URLs (427)Hashes (59)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Associated CVEs (1)

CVE-2026-76581

Sample indicators

IndicatorType
alpinorexa.orgdomain
www.frownappr0veizl.comdomain
americalatinaenelmundo.orgdomain
consultant-life.comdomain
elstattoo.czdomain
sraak.nldomain
kjkgsi-gsjgkan-wintersga.pages.devdomain
startupcv.cadomain
chilloutvrmodded.netdomain
api.camdriverstore.clouddomain
mamahdannirwana.comdomain
fporziolandscaping.comdomain
biggestchlen.loldomain
ascontechnologies.sbsdomain
inno-change.orgdomain
elevatechproj.sbsdomain
kittiescraft.xyzdomain
drminaataei.comdomain
onedistritoresidences.comdomain
ruudho.comdomain
64.227.172.9ip
45.39.33.177ip
64.89.160.67ip
51.38.99.224ip
151.243.113.57ip
136.243.152.105ip
178.105.175.202ip
159.203.95.70ip
193.143.1.24ip
45.138.16.182ip
185.246.223.75ip
72.61.25.108ip
192.121.246.73ip
185.139.230.87ip
185.213.81.52ip
89.47.113.117ip
89.167.118.94ip
178.16.54.80ip
146.19.191.11ip
213.108.22.160ip
http://projectshar94iw8u932u832i32u89iu893u89323u89.pages.dev/url
http://91.92.243.119/stlr/git.exeurl
http://dieserbenni.ruurl
https://voltix.gd/App/Voltix.zipurl
https://discord.com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw5r-3_wbvpG74Lg5sA_iiUtZqEoNZdYVyb1XgCMzbVyL8WzZurl
http://dinasira.pages.dev/url
https://github.com/Siphodhl1980/nbew/releases/download/new/release-project.zipurl
https://unitedbktrust.com/dash/url
https://project-hidd501921.pages.devurl
https://sites.google.com/view/xbrewmacboeurl
http://jcdp-ia.org/url
https://googlemeetmenow.us/meeting.htmlurl
https://claud-new-tools591.pages.devurl
http://projecttetstts23r22we.pages.dev/url
http://homeinspectionsdelaware.com/curl/75ddfbae4fcacede52ef513ce634f82ad3d8358984b0bd49756cc8c50a55d501url
https://github.com/Siphodhl1980/nbew/releases/download/new/main_kah.exeurl
https://nlservices.thedirtysouthdigital.com/planzer/url
https://capmentor.vn/planzer/url
https://kettlewhisper.icuurl
https://marsalek.cy/loginurl

Another file to check? Run a file hash reputation check.