Loading malware…
StageComp is a downloader associated with the Iranian state-linked espionage group MuddyWater, also tracked as Seedworm and linked to Iran’s Ministry of Intelligence and Security. It has been repeatedly tied to MuddyWater through code-signing certificate reuse and historical vendor attribution, and is part of a broader tooling lineage that includes the Darkcomp backdoor. StageComp’s primary role is to deliver follow-on payloads rather than provide a full post-compromise framework itself; reporting specifically links it to deployment of Darkcomp and, in later activity, to delivery chains involving JavaScript remote-access tooling associated with the Smokest campaign identity. The malware has been referenced as legacy MuddyWater tooling that continued to provide attributional continuity into newer operations involving Dindoor, Fakeset, and CastleRAT-related infrastructure. Observed context places StageComp within espionage-focused campaigns targeting organizations of strategic interest, including government, defense, aerospace, financial, transportation, and other sectors relevant to Iranian intelligence collection. High-confidence facts support its classification as a Windows downloader used in staged infection chains and associated with signed malware delivery and follow-on backdoor installation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The “Amy Cherne” signed MSI executable, has a certificate that also signs StageComp (vendor confirmed MuddyWater), StageComp delivers a JS RAT with campaign ID: 75cbe18653d52372 and campaign name: “Smokest” via the `serialmenot.com` C2.
The reuse of code-signing certificates previously associated with MuddyWater malware families, specifically Stagecomp and Darkcomp, creates a direct lineage between legacy and current tooling.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware reportedly tied to Seedworm in public reporting, but the content explicitly notes the name requires verification from the original Broadcom source.
Stagecomp is a downloader previously used by MuddyWater and referenced here through shared code-signing certificate overlap with ms_upd.exe.
Malware attributed to MuddyWater and referenced as being signed with a code-signing certificate linked to the group.
A legacy MuddyWater loader/tool staged alongside newer backdoors during intrusion setup.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.