🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://raw.githubusercontent.com/BrunoCroppi/TLOU2-UndergroundToolkit/main/L%D0%BEader.zip.

Database Entry


IOC ID:2019958
IOC: https://raw.githubusercontent.com/BrunoCroppi/TLOU2-UndergroundToolkit/main/L%D0%BEader.zip
IOC Type :url
Threat Type :payload_delivery
Malware: WARDENStealer
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS54113 FASTLY
Country:- DE
First seen:2026-11-08 07:26:56 UTC
Last seen:never
UUID:6f50efc5-db1c-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:Github lure mediafire WARDENStealer
Reference: https://tria.ge/261107-vvh35sev6k

Avatar
wristhulk
Warden Stealer delivery chain behind a GitHub lure. 125 GitHub accounts (gaming-cheat / trainer repos) serve "Lоader.zip" (Cyrillic о; RAR5) holding only "Download Link.txt" + "Download link.rtf". Each points to sites.google.com/view/github-launcher, which links to a MediaFire zip (rotated: core-sourcecode.zip 07-05, ecore-sourcecode.zip 08-02, ecore-release.zip 10-13, ecore-latest-x64.zip now; page seen since 2026-01). The note tells the victim to disable Defender. Current zip 8be6dce75fa52a328eda4bdb4d557b17fd1592c8c61794a36cd289681c4459e4 (147 MB) holds bin\elaunch-x64.exe d3f34d7ad2003b9976c68d85c80ff4cac6ae794c57d714b21f4d5ec28ad1c162 padded to 629 MB; in our own Win10Lab run (2026-11-07) it wrote Common Files\soructuor.dat and POSTed to wrcreckler.info (UA "raicseost"), already listed here as win.warden_stealer C2. The GitHub URLs serve the lure note, not the payload.