IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE72 IOCs

Warden Stealer: the Rapid Rise of an Infostealer with an Appetite for Ai Agent Data

OT
ORKL Threat Library
Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYEarth LuscaBRONZE UNIVERSITYEarth LuscaINFRASTRUCTUREskibidistealer.teamculture-shock.clubbobroviysmex.shopCAPABILITYVidarVICTIMunknown
Adversary(4)
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise72

TypeIndicatorConfidenceScoreFirst Seen
Domainskibidistealer.team
botnetexploitintel-blog
High
86
Oct 9, 26
Domainculture-shock.club
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainbobroviysmex.shop
botnetintel-blogmalware
High
86
Oct 9, 26
SHA2566e47d6da0e2ab2226ee033e75c7b9b41e4e908d6f71b47d0ce7477a492fb418e
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainpatduggan.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainbacktoblack7.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domainvlad-nazarenko2004.club
exploitintel-blogmalware
High
64
Oct 9, 26
Domainluqiuid91.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domaindiseazhjw.cloud
botnetintel-blogmalware
High
86
Oct 9, 26
Domainpublisher99.com
botnetintel-blogloader
High
86
Oct 9, 26
SHA2560d727a4ef1178e767afdd0080ba1ebda0f24ac52b639f0501021affd8f88d26a
file-hashintel-blogloader
High
61
Oct 9, 26
SHA256cc1f2ae885d317e6c520ea6d219370630c1c7a8fe600b89d0d78fdee28174ff4
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainmacfilecloud8.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domainpianolovers.club
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainsfgiantslive.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domainincoming.rent
botnetintel-blogmalware
High
86
Oct 9, 26
SHA2563d0794fca8ae2ca80eee463b11557d696c48c8ddf17f5e2917cc33fbf0596842
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainwebex-028ue2.com
exploitintel-blogmalware
High
64
Oct 9, 26
Domaindojaekrt.forum
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256b855f6883391e25f1a91692bef76771065b4b0436a014de5b25aa9d0de6238e4
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainwosback.cc
botnetexploitintel-blog
High
86
Oct 9, 26
Domainzalupka.website
botnetexploitintel-blog
High
86
Oct 9, 26
SHA256fea9538084b70e9681fd8104b9319792c4d8c2701ae145ec31dc26e7526f2ae0
file-hashintel-blogmalware
High
61
Oct 9, 26
SHA25677c8266935bc040c992ab70abd402bd203b9c12e7548c80b84fd21308c250f0e
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainhotelcalifornia.club
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA25604beeb716a79661ea770138558dbdebccb493bf6b4b1ec37f19b9c028dea98d5
file-hashintel-blogmalware
High
61
Oct 9, 26
Domaindojaekrt.cc
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainverifytrtr.vip
exploitintel-blogmalware
High
64
Oct 9, 26
Domainlibrary2000.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domainskibidiproliv.com
botnetexploitintel-blog
High
86
Oct 9, 26
Domainsystemformating.rest
botnetexploitintel-blog
High
86
Aug 6, 26
SHA256006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
file-hashintel-blogloader
High
61
Oct 9, 26
Domainbrodyagup.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainnextlanding.net
botnetintel-blogmalware
High
86
Oct 9, 26
Domainkonradkerz40000.work
botnetintel-blogmalware
High
86
Oct 9, 26
SHA256dd1c3b2bfe32b41902ffe875e568f52f44f0900209b9cb447c9ae4444a5dce4e
file-hashintel-blogmalware
High
86
Sep 29, 26
Domainerifytrtr1.vip
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainkaifdlyaw.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainplainhorizon.org
botnetintel-blogmalware
High
86
Oct 9, 26
SHA256e62b24142e7244573cf37cef55b175fbba6a43ac4592d30f8b061dda8866c9b3
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainrrrrrrrfffff.club
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256abcc49cd8a9b08a18ad9e516ec13350e01a05f04f1c5e025080e1c0e3b4bec36
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainnweenwew234.cc
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256a396ccfb5547f04cef4be18ed076bb2c62c571268306d201b6177188f05723f1
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainberff3788.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainrussianaltushkawantdickinside.club
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainmatie-bal.club
botnetintel-blogmalware
High
86
Sep 15, 26
Domainjgkawdq.cloud
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainrocks56.com
botnetintel-blogmalware
High
86
Oct 9, 26
Domainrecap-check.org
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA2565b6ec081f385d91273a79c6645cd0f932539dc267863e5d243657a8ccb5ca351
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainbomboclat.rest
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256241df5a4ee38658329025152807fcd69b7e40361428000bb56d14cadeb48b437
file-hashintel-blogmalware
High
61
Oct 9, 26
SHA25677cc246272f2af21b64bbc6c6173d57affee97eb0ccf747d89492d06d4c52865
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainggresp.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
URLhttps://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis
malwarenetworkresearch
High
67
Oct 16, 26
Domainmodicontools.com
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainkaiangelsystems.rest
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA25651bc797e783b6a765e174736ff12a711a243099f4e19739388e5bce1548a448d
file-hashintel-blogmalware
High
61
Oct 9, 26
Domainweb03-azureupdate.com
exploitintel-blogmalware
High
64
Oct 9, 26
Domainpiska-sosidka-govno.asia
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainzxcwork.com
botnetexploitintel-blog
High
86
Oct 9, 26
Domainhroffice.work
botnetintel-blogmalware
High
86
Oct 9, 26
Domainskibidiclipper.pw
botnetintel-blogmalware
High
86
Oct 9, 26
Domainrabbids-sixseven.cc
botnetintel-blogmalware
High
86
Oct 9, 26
Domainkaliop-weda.club
botnetintel-blogmalware
High
86
Sep 14, 26
SHA25663959ef6309cd01b5d3c7262a3a41394dca2db2dc74bd030a517b7e23a2c3fef
file-hashintel-blogloader
High
61
Oct 9, 26
Domainzolotoy.club
botnetexploitintel-blog
High
86
Aug 6, 26
Domaindojaekrt.trade
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256159b472e0e0bdc05933da64032761cbd042b6cc5dc4e1cd11d5ef7af5180b972
file-hashintel-blogmalware
High
61
Oct 9, 26
SHA256ea9debbe4b3d11bf6c986af63a94e13ceb2a1cbc167a642697fcabc9e8a50439
file-hashintel-blogmalware
High
61
Oct 9, 26
SHA256ff85bb43e546fac541443006878828c47958c1d55dfa32c529651bfcc12832f1
file-hashintel-blogmalware
High
61
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph72 total IOCs
DomainSHA256URL
Domain50SHA25621URL1Actors4Malware1REPORTWarden Stealer: the Rapid Earth LuscaBRONZE UNIVERSITYEarth LuscaEarth LuscaVidar
scroll to zoom · drag to pan · click IOC to open