Unknown Stealer

Malware Family

2 332 indicators of compromise attributed to Unknown Stealer across abuse.ch threat intelligence feeds.

Domains

1 623

IPs

URLs

557

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 623)IPs (65)URLs (557)Hashes (87)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Associated CVEs (1)

CVE-2026-76581

Sample indicators

Indicator	Type
accurateonlinelogin.top	domain
clevergeriatric.icu	domain
sakkoscarped.ru	domain
stealer.to	domain
oturumkaradag.com	domain
eguiagroup.cfd	domain
ledgerlive.ldgr.co.com	domain
www.industry1culture.com	domain
efm-global.com	domain
kindmindsociety.com	domain
bulletproofdomai2n.com	domain
teknolojikbirinsan.com	domain
boucheriee.com	domain
linanil.com	domain
canvaspigeon.icu	domain
owocraft.com	domain
kittyescraft.com	domain
download.get-version.com	domain
companionsecurehighflier.top	domain
sekirolegion.duckdns.org	domain
86.54.25.213	ip
192.253.248.181	ip
64.89.160.67	ip
37.77.150.162	ip
85.209.163.250	ip
162.33.179.91	ip
136.243.152.105	ip
159.203.95.70	ip
193.143.1.24	ip
45.138.16.182	ip
144.126.140.33	ip
217.156.122.75	ip
91.208.197.9	ip
192.121.246.73	ip
193.222.99.18	ip
185.241.208.147	ip
89.47.113.117	ip
178.16.54.80	ip
192.169.7.221	ip
213.108.22.160	ip
https://ebashim1.com/	url
https://web03-azureupdate.com/	url
https://gkkma-glcaks-summ.pages.dev	url
https://uefarafara.forum/	url
http://flwoagent.com/curl/	url
https://ays.gamepazarin.com/e	url
https://weedhack.cy/files/jar/module	url
http://213.165.45.120/Modeceli	url
https://claud-new-tools591.pages.dev	url
http://lc-marshal-and-son.pages.dev/	url
http://207.246.115.233/auth	url
http://pro3y8ed9ucjfby78eujwdcfhsbh8du9ejicsdiodidsiomcasmmasasah.pages.dev/	url
https://storageprofiler.com/	url
https://hybridmediaworks.net/gplznr/	url
https://jgkawdq.cloud/	url
https://hb8uu38hbx872bv28dbh29.pages.dev	url
https://pawsockenjoyer.site/v1/poll	url
https://drogueriasdelmundo.com/wp-includes/assets/ch/planzer/	url
https://boris-vlaga.club/	url
http://projectshare2387yetgbhjnw98e7gdybhsjnmksoi98uhy.pages.dev/	url

Another file to check? Run a file hash reputation check.