🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain sephionecraft.site.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1918317
IOC: sephionecraft.site
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-09-15 06:04:31 UTC
Last seen:never
UUID:9f15bc0a-b0a4-11f1-b569-42010aa4000a
Reporter MrZakurzacz
Reward 5 credits from ThreatFox
Tags:fabric minecraft stealer TraceStealer
Reference: https://www.virustotal.com/gui/file/5923b2f1817eeaa9e3da46b5efa9ae0ecc923e3d94a64b98f0be200669b7c207?nocache=1

Avatar
MrZakurzacz
Malicious Minecraft Fabric mod delivery domain. Victim was contacted via Discord and invited to a Minecraft server. The server rejected the connection and instructed the victim to download a required mod from sephionecraft.site. The downloaded Fabric mod contains an encrypted Windows PE payload, drops it as mc-cache/winhost.exe and executes it. The payload contains references to the already known stealer C2 infrastructure at troysolution.com.tr