Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Deep Dive into Arkanix Stealer and its Infrastructure
Threat Actors
Excerpt
Arkanix Stealer is an actively developed credential‑theft malware family that is primarily advertised on Discord, where its operators have been promoting rapid updates and new feature additions. While the initial release of Arkanix was written in Python, the threat actors have since expanded its capabilities by implementing a C++ variant, marketed as a “Premium” edition. Distribution for both versions appears to rely on Discord, where the malware is shared under the guise of…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | f7d53884a35e5f5149ac4d4d2a2de75b15283edd43ec891e9eae05d194e02b1a | Medium | Score 53/100 | First seen |
| SHA256 | 6960d27fea1f5b28565cd240977b531cc8a195188fc81fa24c924da4f59a1389 | Medium | Score 53/100 | First seen |
| SHA256 | 99b8d3e04f6b16f3b79391360602ca28651c78a0db2f3868fec11eca71727a3d | Medium | Score 53/100 | First seen |
| IP | 195.246.231.60 | High | Score 58/100 | First seen |
| URL | https://arkanix.pw/api/upload/direct | High | Score 58/100 | First seen |
| IP | 93.95.226.152 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…