Malware

IIStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

MITRE ATT&CK techniques ... T1587.001 Develop Capabilities: Malware — IIStealer is a custom-made malware family.

Execution

1 technique

T1569.002Service ExecutionEvidence1

MITRE ATT&CK techniques ... T1569.002 System Services: Service Execution — IIS server (and by extension, IIStealer) persists as a Windows service.

Persistence

1 technique

T1546Event Triggered ExecutionEvidence1

MITRE ATT&CK techniques ... T1546 Event Triggered Execution — IIStealer is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

Privilege Escalation

1 technique

T1546Event Triggered ExecutionEvidence1

MITRE ATT&CK techniques ... T1546 Event Triggered Execution — IIStealer is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE ATT&CK techniques ... T1027 Obfuscated Files or Information — IIStealer uses string stacking in an attempt to avoid some string-based detection.

T1036.005Match Legitimate Resource Name or LocationEvidence1

IIStealer has been deployed under the name dir.dll, in an attempt to mimic a legitimate Microsoft IIS module called dirlist.dll.

Credential Access

1 technique

T1056Input CaptureEvidence1

IIStealer intercepts network traffic between the IIS server and its clients to collect sensitive information such as credit card details.

Collection

3 techniques

T1056Input CaptureEvidence1

IIStealer intercepts network traffic between the IIS server and its clients to collect sensitive information such as credit card details.

T1074.001Local Data StagingEvidence1

MITRE ATT&CK techniques ... T1074.001 Data Staged: Local Data Staging — IIStealer uses a local file to stage collected information.

T1119Automated CollectionEvidence1

MITRE ATT&CK techniques ... T1119 Automated Collection — IIStealer automatically collects information from inbound HTTP requests, such as credit card details.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK techniques ... T1071.001 Application Layer Protocol: Web Protocols — Adversaries send HTTP requests to the compromised IIS server to control IIStealer.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK techniques ... T1041 Exfiltration Over C2 Channel — IIStealer uses its C&C channel to exfiltrate collected data: HTTP requests are sent by the adversary to the compromised IIS server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Aug 9, 2021

IISpy: A complex server-side backdoor with anti-forensic features

Read also: Anatomy of native IIS malware IIStealer: A server-side threat to e-commerce transactions IISerpent: Malware-driven SEO fraud as a service

eset welivesecurity blogNews

Aug 6, 2021

IIStealer: A server-side threat to e-commerce transactions

A malicious native IIS module that intercepts HTTP POST requests on compromised IIS e-commerce servers, logs checkout/payment request bodies containing sensitive customer and credit card data, and exfiltrates the staged data through specially crafted HTTP requests to the server.

eset welivesecurity blogNews

Jan 24, 2026

IISerpent: Malware-driven SEO fraud as a service

IIS malware family referenced as stealing credit card information from e-commerce customers by abusing IIS request/response handling.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

IIStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

MITRE ATT&CK techniques ... T1587.001 Develop Capabilities: Malware — IIStealer is a custom-made malware family.

Execution

1 technique

T1569.002Service ExecutionEvidence1

MITRE ATT&CK techniques ... T1569.002 System Services: Service Execution — IIS server (and by extension, IIStealer) persists as a Windows service.

Persistence

1 technique

T1546Event Triggered ExecutionEvidence1

MITRE ATT&CK techniques ... T1546 Event Triggered Execution — IIStealer is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

Privilege Escalation

1 technique

T1546Event Triggered ExecutionEvidence1

MITRE ATT&CK techniques ... T1546 Event Triggered Execution — IIStealer is loaded by IIS Worker Process (w3wp.exe) when the IIS server receives an inbound HTTP request.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE ATT&CK techniques ... T1027 Obfuscated Files or Information — IIStealer uses string stacking in an attempt to avoid some string-based detection.

T1036.005Match Legitimate Resource Name or LocationEvidence1

IIStealer has been deployed under the name dir.dll, in an attempt to mimic a legitimate Microsoft IIS module called dirlist.dll.

Credential Access

1 technique

T1056Input CaptureEvidence1

IIStealer intercepts network traffic between the IIS server and its clients to collect sensitive information such as credit card details.

Collection

3 techniques

T1056Input CaptureEvidence1

IIStealer intercepts network traffic between the IIS server and its clients to collect sensitive information such as credit card details.

T1074.001Local Data StagingEvidence1

MITRE ATT&CK techniques ... T1074.001 Data Staged: Local Data Staging — IIStealer uses a local file to stage collected information.

T1119Automated CollectionEvidence1

MITRE ATT&CK techniques ... T1119 Automated Collection — IIStealer automatically collects information from inbound HTTP requests, such as credit card details.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK techniques ... T1071.001 Application Layer Protocol: Web Protocols — Adversaries send HTTP requests to the compromised IIS server to control IIStealer.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK techniques ... T1041 Exfiltration Over C2 Channel — IIStealer uses its C&C channel to exfiltrate collected data: HTTP requests are sent by the adversary to the compromised IIS server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Aug 9, 2021

IISpy: A complex server-side backdoor with anti-forensic features

Read also: Anatomy of native IIS malware IIStealer: A server-side threat to e-commerce transactions IISerpent: Malware-driven SEO fraud as a service

eset welivesecurity blogNews

Aug 6, 2021

IIStealer: A server-side threat to e-commerce transactions

eset welivesecurity blogNews

Jan 24, 2026

IISerpent: Malware-driven SEO fraud as a service

IIS malware family referenced as stealing credit card information from e-commerce customers by abusing IIS request/response handling.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.