Unknown Stealer

Malware Family

1 476 indicators of compromise attributed to Unknown Stealer across abuse.ch threat intelligence feeds.

Domains

1 038

IPs

56

URLs

340

Hashes

42

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
nenadopapa.cfddomain
orcaleagent.comdomain
loadfilerun.comdomain
fibafa.comdomain
minicraft.worlddomain
sprayboothspecialists.comdomain
sweetiecraft.netdomain
thiruvallur.indomain
pace-draft.sbsdomain
soloecommerce.itdomain
mail.socialsecurityprimer.comdomain
insihgtagent.comdomain
cpanel.blancosettlement.comdomain
proj-hid513291kzg.pages.devdomain
garden-sugizo.comdomain
premierrentalpurchase.comdomain
serv-in.frdomain
cgequipmentleasing.comdomain
escortseohizmetleri.comdomain
psicogenealogia.com.brdomain
192.253.248.181ip
64.227.172.9ip
64.89.160.67ip
51.38.99.224ip
130.61.68.232ip
151.243.113.57ip
185.165.169.57ip
159.203.95.70ip
178.62.245.59ip
193.143.1.24ip
209.99.191.241ip
45.138.16.182ip
78.111.111.236ip
146.19.213.175ip
45.134.173.79ip
193.222.99.18ip
8.228.95.3ip
178.16.54.80ip
62.60.226.97ip
192.169.7.221ip
http://premierrentalpurchase.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381url
https://claghemaxc.com/url
http://regenia-washington.pages.dev/url
https://macwhisper.org/url
https://callpit.icu/api/clienturl
http://136.243.152.105/api/telemetry/file-chunkurl
https://pinescope11.com/curl/80ee53d07eee377f78c6ecbc5b40b6936703eefcb6e40a79d7af80bb53d9f1a7url
http://185.241.208.147/download/payload.exe.brurl
http://loio.pages.dev/url
http://projectsharew78yh3edhyu3eduhneduhnbedcuhbedch.pages.dev/url
http://213.165.45.120/Wogaxuurl
https://ember-30.com/api/metrics/run?event=pastedurl
http://vacationrentalvirginia.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381url
https://breinsmas.com/url
https://hacelu.com/curl/7856125165158b06b00d0acf49c34ea26cbc0b250103a48c746c0eb23b31cbc5url
http://servicesense.org/url
http://213.165.45.120/newoneurl
http://proofpoint-workflow.pages.dev/url
https://c3lestial.fun/receive.phpurl
https://featherwallet.io/download.php?direct=trueurl