Skip to main content

Stealc

Malware Family

6 085 indicators of compromise attributed to Stealc across abuse.ch threat intelligence feeds.

Domains

14

IPs

217

URLs

444

Hashes

5 410

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (14)IPs (217)URLs (444)Hashes (5 410)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
windows-update-local.restdomain
cloud-flare-authenticator.linkdomain
cloud-flare-authenticator.clickdomain
svhost-update-service.casadomain
friendihelp.infodomain
api.nailproxy.spacedomain
spellmarketplace.clubdomain
ashpaltlonpro.comdomain
dakatawebstick.comdomain
uehfks.digitaldomain
777palm.comdomain
clubsoar.comdomain
artistichairlounge.comdomain
ayelife57.restdomain
196.251.107.217ip
160.20.109.16ip
23.94.252.49ip
91.92.241.69ip
193.178.158.55ip
166.88.2.38ip
176.65.144.87ip
216.203.20.148ip
146.103.127.46ip
80.76.49.106ip
150.241.66.52ip
104.251.180.218ip
89.46.38.100ip
31.77.199.86ip
194.33.61.203ip
85.137.252.166ip
78.46.40.151ip
85.239.144.221ip
62.60.226.26ip
91.92.240.190ip
http://185.190.250.43/a4b374f33e9c46af.phpurl
https://sss.fbdfsgfwrgerwefew.top/url
http://37.221.66.166/4a815a53876a4172.phpurl
http://77.91.96.222:7777/gate/ed3b194a53b1d17525ba6396eeurl
http://158.94.209.112/url
http://176.113.115.26/e50a8a413d120466.phpurl
http://92.255.57.88/7bbacc20a3bd2eb5.phpurl
http://getgoodsa.linkurl
http://158.94.209.172/f9c376230e95425f.phpurl
http://43.228.157.66url
http://91.107.224.80/649938577e826117.phpurl
http://94.131.107.238/3aa13fff14e398a1.phpurl
http://213.165.47.49/b0c9ed38f2b14c119546.phpurl
http://193.178.158.55/auth.phpurl
http://45.131.214.233url
http://45.87.153.135/5d4f090c730016b1.phpurl
http://217.119.129.37/2a7400fe251b4b4687fe.phpurl
http://ronaldlitt.top/25d4fc7fb0cb6b78.phpurl
http://179.43.142.99/7525b57b5f844240.phpurl
http://179.198.49.41/url
46da98623451fd2f93625abb2cb15b74a449f4b82be1c255cf692fc7d6a6dbcchash
524f9cb7204f60100bf0602c9d6469b31bfe9696b22c6281a018a952d4dd45a1hash
434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61hash
02a01859a6636016393dec9c654cdcf811ad6cfbc205a5c8f56b150ceea2e3e6hash
e1a44604533a1b1d897da2c3263b0252043a9a5e8acc2c6d20a46e59f84e4a52hash
1bc53f714339ceb8af3f5779e3c764f7db74cf77a44b5243deb95d6c7c5ea6d8hash

Another file to check? Run a file hash reputation check.