Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE53 IOCs

STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

Google Threat Intelligence (GTIG / Mandiant)

Published June 25, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(2)

Infrastructure

Capability(2)

Victim

Indicators of Compromise

Indicators of Compromise53

Type	Indicator	Confidence	Score	First Seen
SHA256	f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e exploitfile-hashintel-blog	Medium	53	Oct 9, 26
SHA256	19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ff file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da file-hashintel-blogmalware	Medium	53	Oct 9, 26
CVE	CVE-2025-8088 aptespionageexploit	High	67	Jun 2, 26
SHA256	1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	ed88a43801b5c58b9be27fa74abaa278a48904f3cc1bc905f2d85e32448b96c5 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cff file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6 file-hashindicatorintel-blog	Medium	43	Jun 26, 26
SHA256	9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24 file-hashindicatorintel-blog	Medium	43	Jun 26, 26
SHA256	e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ce file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	77417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0 file-hashintel-blogmalware	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph53 total IOCs

SHA256CVE

scroll to zoom · drag to pan · click IOC to open