Hermes (Stealer)

Name: Hermes (Stealer) indicators of compromise
Creator: isMalicious
Keywords: Hermes (Stealer), malware, IOC, botnet_cc, payload

Malware Family

18 indicators of compromise attributed to Hermes (Stealer) across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Botnet C&Cpayload

Indicator	Type
144.31.53.142	ip
http://216.158.95.183:8093/chunks/p_3e3b1bbfab33ca78/v3/manifest.json	url
http://193.148.56.77:8093/chunks/p_230c267932c77a53/manifest.json	url
http://193.148.56.77:8093/files/bld_4Aj52lBKdt6aPc06eCeFHbos.exe	url
http://144.31.53.142:8093/chunks/p_cd2f8d7fd6dbd230/v3/manifest.json	url
http://144.31.53.142:8093/files/bld_C6h67XDjY-FEeNPOAEDhElF9.exe	url
http://158.94.211.124:8093/files/bld_dDXGepIlKOZeWWMcNkG2aVIk.exe	url
http://144.31.53.142:8787/api/client/report	url
http://158.94.211.124:8093/chunks/p_269a7a0a541c348d/v3/manifest.json	url
http://193.148.56.77:8093/files/hb/	url
http://216.158.95.183:8093/files/bld_WrhPmSV4V4TJSTXsDdtCrIh2.exe	url
http://144.31.53.142:8080/ws/publisher	url
5f961bd913c332c97c5393da3e8430f1f8a811f44ebbb049db47ff435d060eb8	hash
90d527fa9b8bde1c4965293428eeeaad4fd527e7d2271dd02a4404a9de8376d9	hash
f8dfee4f37a0e8ddeba1b31a116997b7f5080d5ca243f747a255c99e2441350a	hash
f26a0a27dfa8b7f20413a6c1818752cf25031cf9700ca7ffaa161e7b16eb16c2	hash
fa647a4d12cc887bd96cb2eb126f161cbcf47e84312094bb0dcc2429e7c8e296	hash
578cc6d26bf7c5536d2c0ea0df5a788155e15d09e49054303915b535f4012791	hash

Another file to check? Run a file hash reputation check.