Skip to main content

MaskGramStealer

Malware Family

280 indicators of compromise attributed to MaskGramStealer across abuse.ch threat intelligence feeds.

Domains

8

IPs

0

URLs

18

Hashes

254

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
proxymonster.saledomain
zauber-edgecb61leise.icudomain
samtpfotchensnezhok9566leisegepard.sbsdomain
geschmeidig6307-kotyatanet.sbsdomain
ws.geschmeidig6307-kotyatanet.sbsdomain
hongkongplazaworks.topdomain
ryzhikpix6956sanft.cfddomain
kirk-service.livedomain
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/m3o1azkhufs1enkurl
https://ms.com-audio.cloud/files/url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/q7cherolivolejkurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ufcx6bc1ef45e7gurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/a7k56jotufo5ab4url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ujgti3g12f45y74url
https://gist.githubusercontent.com/HexReaper/eec6869214d2b4e12bd606529128f8c2/raw/gistfile1.txturl
https://hydrax.live/download/HydraCheat.7.5.1.zipurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/6v4de3o1yz0du7kurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/2vk56j8h27whyzgurl
http://kirk-service.live/reconcileurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/iro9a3cp6zsd230url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ejk52zwt2js16rourl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/yzc5yj81yv0h2fwurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/y74habwtyvsxarwurl
http://83.217.208.72:6062/url
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/mzcxijwx2zg9e7wurl
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/6v0tazc5mboxujsurl
4b63966f723fc87c3b35494130ad59ef2f71a235c01f06956e4ee9ce67a6ebb5hash
fdae212f90cc7296bf4bae2b265a093ca98ef5caa0034a0db063d17084e22da3hash
9190f3209cbb11da41e8d4abedb5736f48965a0c02059077776af399f8320ba6hash
fe788b4069140e15ef9e40e1195ae701db1d7b555e95689767fe3d1c041e5e13hash
abb8939d54062dcc47e589f1b3a738cd6f9daa721ddf40d9643ece9ee540e36ehash
4d8b7ee5f7d5f3e54fc380a318bcbb5c8c4b57dd71e9d8e9f8c9d829fb8a5a82hash
90bb3c411fffd0b0969cf9358658963c41ddc3b43ed7b957dad79db58d29e7e6hash
540c3a52fee60aaea28abc5b11a5327d8ef435d425ddbec13e0adc1afd027b2fhash
56814b56d1cf5426f6b2a09fa9f8d2d4a944b7ecb9eacc7115c340f63a1fe008hash
25def151599e0848c71cebf82455ea4afd253b0b29cd966506108295ff41e1a0hash
8201551520d88da852863c340230da37feff7e3f0a99d983c29baf315af37a49hash
17fb07ccb48466c67c97e5687fa753ec7d21be55f71bfe7bdba056c5972890ddhash
90b7139ae18d7f529400fcb871a0d411502b5a8d924f7abd3650490286bd241fhash
a438c69b924e1396129de458136536b3c65353f3e525de7aa658dde43e488318hash
51242d1f06d41c80ea8c6fa541be3d6ehash
36f8755329d502f9567c36c254fac20673b15f96d8ccb99fdc4bed67e8d36937hash
e5931f6d43f7f2081e9b09803b063cc56bddaaf36f8fcd15bbb987dc45e6be88hash
b847c47d4a5924064755207423d38c13658b43d4c395cdd2f63e7079520541behash
23c758e56e0f7f446f5a07e3d9321eb40d764044ad455f6276b476552d390015hash
ca52167384cd316ce0738c34715112dd00d168e749d06b32a686e052d8e8eb54hash

Another file to check? Run a file hash reputation check.