ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 155dc73761ebaab0e4f5c0e18cf09dbd5728ce61361db218a5727355ca8adc1a.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1796619
IOC: 155dc73761ebaab0e4f5c0e18cf09dbd5728ce61361db218a5727355ca8adc1a
IOC Type :sha256_hash
Threat Type :payload
Malware: Stealc
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-04-23 14:00:49 UTC
Last seen:never
UUID:722d0b9c-3f19-11f1-8759-42010aa4000a
Reporter o_zehentleitner
Reward 5 credits from ThreatFox
Tags:github-typosquatting nailproxy Stealc unicorn-binance-websocket-api
Reference: https://blog.technopathy.club/nailproxy-space-github-malware-campaign

Avatar
o_zehentleitner
Sibling loader build by same operator (discovered via VT pivot on spellmarketplace.club). Same sysconf.exe masquerade family, different imphash (2a1bc7afa03be791d9a036b04d2b1ffb), different richhash, same exfil C2 infrastructure. First seen 2026-04-19. Delivery chain unknown (not via nailproxy.space).