🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://api.failproxy.space/api/v1/auth/session.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1968847
IOC: https://api.failproxy.space/api/v1/auth/session
IOC Type :url
Threat Type :botnet_cc
Malware: Stealc
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-10-16 06:10:31 UTC
Last seen:never
UUID:73301c9f-c91a-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:Github Loader Stealc
Reference: https://bazaar.abuse.ch/sample/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e/

Avatar
wristhulk
C2 of a Python loader distributed via GitHub fake crypto-tool repos (github.com/RomanZhukov9/Crypto-Recovery-Tool, github.com/pverhoeven74/Crypto-Clipper). The loader POSTs HMAC-signed requests to /api/v1/auth/session and /api/v1/data/sync, receives an AES-GCM-encrypted PE and runs it reflectively in memory. Identical code and paths to lures using api.nailproxy.space (ThreatFox: Stealc); both domains on the same Cloudflare NS pair (coleman/magali), Namecheap, failproxy.space created 2026-06-16. Decoded statically in an isolated lab.