IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE6 IOCs

Deep Dive into Arkanix Stealer and its Infrastructure

DE
DeXpose
Published December 22, 2025Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSandwormINFRASTRUCTURE195.246.231.60https://arkanix.pw/ap…93.95.226.152CAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability
Victim

Indicators of Compromise

Indicators of Compromise6

TypeIndicatorConfidenceScoreFirst Seen
SHA256f7d53884a35e5f5149ac4d4d2a2de75b15283edd43ec891e9eae05d194e02b1a
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA2566960d27fea1f5b28565cd240977b531cc8a195188fc81fa24c924da4f59a1389
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA25699b8d3e04f6b16f3b79391360602ca28651c78a0db2f3868fec11eca71727a3d
file-hashintel-blogmalware
Medium
53
Oct 9, 26
IP195.246.231.60
intel-blogmalwarenetwork
High
58
Oct 9, 26
URLhttps://arkanix.pw/api/upload/direct
exfiltrationintel-blogmalware
High
58
Oct 9, 26
IP93.95.226.152
intel-blogmalwarenetwork
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph6 total IOCs
SHA256IPURL
SHA2563IP2URL1Actors1REPORTDeep Dive into Arkanix SteSandworm
scroll to zoom · drag to pan · click IOC to open