Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE27 IOCs

StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

Microsoft Threat Intelligence

Published June 24, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(6)

Capability(6)

Victim

Indicators of Compromise

Indicators of Compromise27

Type	Indicator	Confidence	Score	First Seen
SHA256	8f32456359f209a63adfd24b94235e1727382ac7f7bb7f2bcaf754e721925b64 file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	5f5b25b2e35d404034d0d60975cf1ffbc6f141761ec3f4f15d6f7c6213a056f6 file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://svclsc.com/ms/index.php intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	d43c988d6f9cb355497696b580621fb1bdb7b6ed6d90f97520ecf6da5a1a41ff file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://spasopro.at/Lsge63sd3/index.php  intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	1246c5b89ab668c1137f377507bc3e266a98e93248382aa026610ae1e764a497 file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://roger99699.xyz/425f1faf4b214434b8a3.php intel-blogmalwarenetwork	High	58	Jun 25, 26
URL	http://goodpanelforgoodjob.com/hg8jjfSr5hy/index.php intel-blogmalwarenetwork	High	58	Jun 25, 26
URL	http://secure.controlpanel.asia/330311481fe14ab99814.php botnetintel-blogmalware	High	86	Jun 2, 26
URL	http://polse.us/62ea47cac2534aa18f74.php intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	977b33a9b481cf714946b7d386865cd5d284312aa5ecfa0546c197b1003e1bde file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	b7d1f172ff3feafe65d47fd1cbe0cc249316371ae0e1cbe3a7c741c738b3353d file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1 file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	43455f1ff4a623b783da670d052eb77eaaacb0c66a9f1e8508f802bf22e8129e file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	https://bartsen284.online/39d9612df78e45b5a4bb.php intel-blogmalwarenetwork	High	58	Jun 25, 26
URL	http://microsoft-telemetry.at/cvdfnaFJBmC0/index.php intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	99507f18c4e61fdb109805404bf6a79ea8ce2fddc590ce48d717e97516ab7e8d file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://rebustan.top/gd7djkDveE2/index.php intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	ca4d4c4fc3e5d5cfa922b898f2d7411f03a446dddb139ba45dfd4f8f0018b64f file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	9383572a30ae5b76fadd0700fbd7a1aa7b05d0b6c8f9cdaef9b30a3e1f65d57d file-hashintel-blogmalware	Medium	53	Jun 25, 26
SHA256	30cef3d3d956e83e2c50579cfbe57a49159cccbcc8b0b0422f27d55e1c401ad9 file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://bluescry.com/01f96fd710e905ca2326.php intel-blogmalwarenetwork	High	58	Jun 25, 26
URL	https://neltron-geltron.shop/e396586b99ee49d19cc3.php intel-blogmalwarenetwork	High	58	Jun 25, 26
SHA256	0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624 file-hashintel-blogmalware	Medium	53	Jun 25, 26
URL	http://cdntestconnect.com/ed54b97a570943999715.php botnetintel-blogloader	High	86	Jun 2, 26

IOC Relationship Graph

IOC Relationship Graph27 total IOCs

SHA256URL

scroll to zoom · drag to pan · click IOC to open