Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
72 IOCs
Warden Stealer: the Rapid Rise of an Infostealer with an Appetite for Ai Agent Data
Threat Actors
Malware Families
Excerpt
https://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data By Vojtěch Krejsa, Jan Rubín Published: 2026-10-08 · Archived: 2026-10-16 02:00:45 UTC Key Points Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a- service (MaaS) infostealer written in the Rust programming language that has, within just a few months,…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →72 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | skibidistealer.team | High | Score 86/100 | First seen |
| Domain | culture-shock.club | High | Score 64/100 | First seen |
| Domain | bobroviysmex.shop | High | Score 86/100 | First seen |
| SHA256 | 6e47d6da0e2ab2226ee033e75c7b9b41e4e908d6f71b47d0ce7477a492fb418e | High | Score 61/100 | First seen |
| Domain | patduggan.com | High | Score 64/100 | First seen |
| Domain | backtoblack7.com | High | Score 86/100 | First seen |
| Domain | vlad-nazarenko2004.club | High | Score 64/100 | First seen |
| Domain | luqiuid91.com | High | Score 86/100 | First seen |
| Domain | diseazhjw.cloud | High | Score 86/100 | First seen |
| Domain | publisher99.com | High | Score 86/100 | First seen |
| SHA256 | 0d727a4ef1178e767afdd0080ba1ebda0f24ac52b639f0501021affd8f88d26a | High | Score 61/100 | First seen |
| SHA256 | cc1f2ae885d317e6c520ea6d219370630c1c7a8fe600b89d0d78fdee28174ff4 | High | Score 61/100 | First seen |
| Domain | macfilecloud8.com | High | Score 86/100 | First seen |
| Domain | pianolovers.club | High | Score 64/100 | First seen |
| Domain | sfgiantslive.com | High | Score 86/100 | First seen |
| Domain | incoming.rent | High | Score 86/100 | First seen |
| SHA256 | 3d0794fca8ae2ca80eee463b11557d696c48c8ddf17f5e2917cc33fbf0596842 | High | Score 61/100 | First seen |
| Domain | webex-028ue2.com | High | Score 64/100 | First seen |
| Domain | dojaekrt.forum | High | Score 64/100 | First seen |
| SHA256 | b855f6883391e25f1a91692bef76771065b4b0436a014de5b25aa9d0de6238e4 | High | Score 61/100 | First seen |
| Domain | wosback.cc | High | Score 86/100 | First seen |
| Domain | zalupka.website | High | Score 86/100 | First seen |
| SHA256 | fea9538084b70e9681fd8104b9319792c4d8c2701ae145ec31dc26e7526f2ae0 | High | Score 61/100 | First seen |
| SHA256 | 77c8266935bc040c992ab70abd402bd203b9c12e7548c80b84fd21308c250f0e | High | Score 61/100 | First seen |
| Domain | hotelcalifornia.club | High | Score 64/100 | First seen |
| SHA256 | 04beeb716a79661ea770138558dbdebccb493bf6b4b1ec37f19b9c028dea98d5 | High | Score 61/100 | First seen |
| Domain | dojaekrt.cc | High | Score 64/100 | First seen |
| Domain | verifytrtr.vip | High | Score 64/100 | First seen |
| Domain | library2000.com | High | Score 86/100 | First seen |
| Domain | skibidiproliv.com | High | Score 86/100 | First seen |
| Domain | systemformating.rest | High | Score 86/100 | First seen |
| SHA256 | 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c | High | Score 61/100 | First seen |
| Domain | brodyagup.com | High | Score 64/100 | First seen |
| Domain | nextlanding.net | High | Score 86/100 | First seen |
| Domain | konradkerz40000.work | High | Score 86/100 | First seen |
| SHA256 | dd1c3b2bfe32b41902ffe875e568f52f44f0900209b9cb447c9ae4444a5dce4e | High | Score 86/100 | First seen |
| Domain | erifytrtr1.vip | High | Score 64/100 | First seen |
| Domain | kaifdlyaw.com | High | Score 64/100 | First seen |
| Domain | plainhorizon.org | High | Score 86/100 | First seen |
| SHA256 | e62b24142e7244573cf37cef55b175fbba6a43ac4592d30f8b061dda8866c9b3 | High | Score 61/100 | First seen |
| Domain | rrrrrrrfffff.club | High | Score 64/100 | First seen |
| SHA256 | abcc49cd8a9b08a18ad9e516ec13350e01a05f04f1c5e025080e1c0e3b4bec36 | High | Score 61/100 | First seen |
| Domain | nweenwew234.cc | High | Score 64/100 | First seen |
| SHA256 | a396ccfb5547f04cef4be18ed076bb2c62c571268306d201b6177188f05723f1 | High | Score 61/100 | First seen |
| Domain | berff3788.com | High | Score 64/100 | First seen |
| Domain | russianaltushkawantdickinside.club | High | Score 64/100 | First seen |
| Domain | matie-bal.club | High | Score 86/100 | First seen |
| Domain | jgkawdq.cloud | High | Score 64/100 | First seen |
| Domain | rocks56.com | High | Score 86/100 | First seen |
| Domain | recap-check.org | High | Score 64/100 | First seen |
| SHA256 | 5b6ec081f385d91273a79c6645cd0f932539dc267863e5d243657a8ccb5ca351 | High | Score 61/100 | First seen |
| Domain | bomboclat.rest | High | Score 64/100 | First seen |
| SHA256 | 241df5a4ee38658329025152807fcd69b7e40361428000bb56d14cadeb48b437 | High | Score 61/100 | First seen |
| SHA256 | 77cc246272f2af21b64bbc6c6173d57affee97eb0ccf747d89492d06d4c52865 | High | Score 61/100 | First seen |
| Domain | ggresp.com | High | Score 64/100 | First seen |
| URL | https://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis | High | Score 67/100 | First seen |
| Domain | modicontools.com | High | Score 64/100 | First seen |
| Domain | kaiangelsystems.rest | High | Score 64/100 | First seen |
| SHA256 | 51bc797e783b6a765e174736ff12a711a243099f4e19739388e5bce1548a448d | High | Score 61/100 | First seen |
| Domain | web03-azureupdate.com | High | Score 64/100 | First seen |
| Domain | piska-sosidka-govno.asia | High | Score 64/100 | First seen |
| Domain | zxcwork.com | High | Score 86/100 | First seen |
| Domain | hroffice.work | High | Score 86/100 | First seen |
| Domain | skibidiclipper.pw | High | Score 86/100 | First seen |
| Domain | rabbids-sixseven.cc | High | Score 86/100 | First seen |
| Domain | kaliop-weda.club | High | Score 86/100 | First seen |
| SHA256 | 63959ef6309cd01b5d3c7262a3a41394dca2db2dc74bd030a517b7e23a2c3fef | High | Score 61/100 | First seen |
| Domain | zolotoy.club | High | Score 86/100 | First seen |
| Domain | dojaekrt.trade | High | Score 64/100 | First seen |
| SHA256 | 159b472e0e0bdc05933da64032761cbd042b6cc5dc4e1cd11d5ef7af5180b972 | High | Score 61/100 | First seen |
| SHA256 | ea9debbe4b3d11bf6c986af63a94e13ceb2a1cbc167a642697fcabc9e8a50439 | High | Score 61/100 | First seen |
| SHA256 | ff85bb43e546fac541443006878828c47958c1d55dfa32c529651bfcc12832f1 | High | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…