TF-2019628
high
📛 Threat Title
WARDENStealer: URL that delivers a malware payload https://raw.githubusercontent.com/khirane/TargetDiarization/refs/heads/main/L%D0…
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: WARDENStealer. Confidence: 75. First seen: 2026-11-07 22:43:09 UTC. Reporter: wristhulk. Tags: Github, lure, mediafire, WARDENStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://raw.githubusercontent.com/khirane/targetdiarization/refs/heads/main/l%d0%beader.zip
UrlVoid 1 / 36
IOC database
- Type
- url
- Value
https://raw.githubusercontent.com/khirane/targetdiarization/refs/heads/main/l%d0%beader.zip- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to WARDENStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: WARDENStealer. Confidence: 75. First seen: 2026-11-07 22:43:09 UTC. Reporter: wristhulk. Tags: Github, lure, mediafire, WARDENStealer.
- External reference Threatfox IOCs/Threats
Remediations (10)
-
web:cybersecuritynews.com
Warden Stealer spreads via fake downloads and ads, stealing passwords, browser data and crypto wallets with a built-in clipper.
-
web:dti.domaintools.com
Hunting for new malware delivery infrastructure often entails the identification and tracking of common techniques to deliver various stages of malware . See what our researchers stumbled upon.
-
web:feed.craftedsignal.io
New command-and-control infrastructure and payload hashes for WARDENStealer information-stealing malware were identified on November 4, 2026.
-
web:github.com
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs , sensitive data patterns, fuzzing payloads , web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that ...
-
web:github.com
A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:malwareanalyzer.com
MalwareAnalyzer is a public malware analysis and threat intelligence platform. You submit a file, a URL , or a hash, and it returns a verdict backed by multi-engine static scanning, real sandbox execution, extracted indicators, and a threat graph you can pivot through.
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:windowsforum.com
SpyCloud reports that Windows stealers WardenStealer and Aoki collect tokens, cookies, API keys, and config files from AI coding tools, risking session hijacking.
-
web:www.sonicwall.com
This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of WardenStealer malware . WardenStealer is highly evasive and uses multiple types of obfuscation, encoding, and indirect calls to prevent analysis, monitor the system and exfiltrate data. In addition, Java library use means the binary is loaded as a DLL instead of a normal PE file when run.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.