IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE2 IOCs

Technical Analysis of Marco Stealer

ZT
Zscaler ThreatLabz
Published February 5, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSandwormINFRASTRUCTUREhttp://45.74.19.20:49…http://217.156.50.228…CAPABILITYLummaRhadamanthysVICTIMunknown
Adversary(1)
Infrastructure(2)
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise2

TypeIndicatorConfidenceScoreFirst Seen
URLhttp://45.74.19.20:49259/receive
intel-blogmalwarenetwork
High
58
Oct 9, 26
URLhttp://217.156.50.228:8181/nujbOqrNYyLXXLmOhPpY/PNcWncSY.exe
intel-blogloadermalware
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph2 total IOCs
URL
URL2Actors1Malware2REPORTTechnical Analysis of MarcSandwormLummaRhadamanthys
scroll to zoom · drag to pan · click IOC to open