MB-8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc
high
📛 Threat Title
WARDENStealer: jli.dll
Description
File type: exe. Size: 725504 bytes. Tags: DIVINEX, exe, stealer, Warden, WARDENStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:05:45.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc
IOC database
- Type
- hash_sha256
- Value
8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- WARDENStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
95ca2eac1d346c24d5c9569c041c65ce2b0261d9
IOC database
- Type
- hash_sha1
- Value
95ca2eac1d346c24d5c9569c041c65ce2b0261d9- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- SHA1 hash of a malware sample (payload) attributed to Raven Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
90422f53fafcfb51cf5a748334d99c3a
IOC database
- Type
- hash_md5
- Value
90422f53fafcfb51cf5a748334d99c3a- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- MD5 hash of a malware sample (payload) attributed to Raven Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
48142bcc502072949779d1c88df4d729
IOC database
- Type
- hash_imphash
- Value
48142bcc502072949779d1c88df4d729- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 725504 bytes. Tags: DIVINEX, exe, stealer, Warden, WARDENStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:05:45.
Remediations (10)
-
web:any.run
Online sandbox report for jli.dll , tagged as evasion, snake, keylogger, stealer, smtp, verdict: Malicious activity
-
web:blog.gridinsoft.com
WARDEN Stealer is the name used for a Windows x64 stealer, cryptocurrency-address clipper, and loader advertised by an actor called WardenStealer . KrakenLabs observed and documented the advertisement on July 24, 2026.
-
web:cybersecuritynews.com
Warden Stealer spreads via fake downloads and ads, stealing passwords, browser data and crypto wallets with a built-in clipper.
-
web:detection.fyi
Detects potential DLL side-loading of jli.dll . JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. Sigma rule (View on GitHub)
-
web:hijacklibs.net
jli.dll is loaded by 3 applications vulnerable to DLL Sideloading. Find out on HijackLibs which apps are vulnerable, how you can detect malicious use of jli.dll , and how to remediate.
-
web:threatfox.abuse.ch
Unpacked Warden Stealer (YapStealer) x64 payload extracted from jli.dll loader 07a491805b23d8ebf039f56c43107261a6d3a2014ae39ec513dfb4415220ca73; C2s satinett.pics ...
-
web:threatfox.abuse.ch
Unpacked Warden Stealer (YapStealer) x64 payload extracted from jli.dll loader 8dcf87fa85ae6f9ddf83cd6cf9754d8ddc4f5eb3a2be4f47505b474a934666fc; C2s falaheeh.mom ...
-
web:www.joesandbox.com
Deep Malware Analysis - Joe Sandbox Analysis Report Loading Joe Sandbox Report ... Play interactive tourEdit tour Windows Analysis Report jli.dll.dll
-
web:www.joesandbox.com
The inspected DLL-entry path returns success, while exported functions provide separate execution paths into obfuscated logic. In particular, JLI_Launch at 0x180003259 calls the shared routine at 0x180003ea1. That routine initializes constants, atomically updates a one-time flag, and transfers control through a relative-offset table.
-
web:www.microsoft.com
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.