Loading malware…
Scranos is a Windows malware family associated with a broader Chinese-linked cybercriminal ecosystem focused on monetizing compromised online accounts, social-platform abuse, and ad fraud. It has been grouped with related families such as SilentFade, StressPaint, FacebookRobot, and CopperStealer based on overlapping operational context and ecosystem ties. Reporting has described Scranos as expanding from activity initially centered in China to a wider global victim base.
High-confidence public reporting in this context does not provide a detailed technical profile of Scranos itself comparable to the documentation available for SilentFade or CopperStealer. However, its repeated association with malware families used to steal credentials and session data, abuse social-media and advertising accounts, and support downstream monetization indicates that Scranos belongs to the same general criminal malware cluster targeting consumer Windows systems and online-service accounts. Specific infection vectors, internal components, and full capability details for Scranos are not available here at sufficient confidence to state more precisely.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as another malware family in the same general class as CopperStealer.
Rootkit mentioned only in related coverage links.
Related malware family with a Facebook-focused component, malicious JavaScript injection into browsers, and a bundled kernel-mode rootkit for persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.