🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain trucnher.skin.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1970657
IOC: trucnher.skin
IOC Type :domain
Threat Type :botnet_cc
Malware: WARDENStealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-10-17 05:32:43 UTC
Last seen:never
UUID:5db20704-c9ca-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:DvnX WARDENStealer YapStealer
Reference: https://bazaar.abuse.ch/sample/e5b790c3a237edc2c55f01a7c648d0eaf8e969a1a9223aff605a90a1d42900b7/

Avatar
Daydream
Warden Stealer (YapStealer) control servers decoded from the unpacked stealer payload (sha256 8351041a32a2c892ab9349120616870b5095d05752f4d3e355d8158c2bc02cbd) inside DvnX.exe loader e5b790c3a237edc2c55f01a7c648d0eaf8e969a1a9223aff605a90a1d42900b7 (MalwareBazaar 2026-10-15). Extracted via static analysis and Unicorn emulation of the 5-step DvnX PRNG/unshuffle/Base64/keystream-XOR/LZSS decoder; hosts not contacted.