MB-0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5
high
📛 Threat Title
WARDENStealer: jli.dll
Description
File type: exe. Size: 740864 bytes. Tags: DIVINEX, exe, stealer, Warden, WARDENStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:01:59.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5
IOC database
- Type
- hash_sha256
- Value
0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- WARDENStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
562920f28337507f9f25c7d9236191c6333d56b1
IOC database
- Type
- hash_sha1
- Value
562920f28337507f9f25c7d9236191c6333d56b1- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
e18b0f4c6bdb6a1810ce828e145cbb39
IOC database
- Type
- hash_md5
- Value
e18b0f4c6bdb6a1810ce828e145cbb39- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
6cbf7cbe1c2cf2cf0625136ca3f2a098
IOC database
- Type
- hash_imphash
- Value
6cbf7cbe1c2cf2cf0625136ca3f2a098- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 740864 bytes. Tags: DIVINEX, exe, stealer, Warden, WARDENStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:01:59.
Remediations (10)
-
web:any.run
Online sandbox report for jli.dll , tagged as evasion, snake, keylogger, stealer, smtp, verdict: Malicious activity
-
web:blog.gridinsoft.com
WARDEN Stealer is the name used for a Windows x64 stealer, cryptocurrency-address clipper, and loader advertised by an actor called WardenStealer . KrakenLabs observed and documented the advertisement on July 24, 2026.
-
web:cybersecuritynews.com
Warden Stealer spreads via fake downloads and ads, stealing passwords, browser data and crypto wallets with a built-in clipper.
-
web:malware-guide.com
Simple Steps To Eliminate Malicious Application WARDEN Stealer is a dangerous type of malware designed to steal personal and financial information from Windows computers. It is a small program, making it easy for cybercriminals to spread through fake downloads, phishing emails, or malicious websites. Instead of being sold once, WARDEN is offered as a subscription In order to remove WARDEN ...
-
web:threatfox.abuse.ch
Unpacked Warden Stealer (YapStealer) x64 payload extracted from jli.dll loader 07a491805b23d8ebf039f56c43107261a6d3a2014ae39ec513dfb4415220ca73; C2s satinett.pics ...
-
web:threatfox.abuse.ch
Unpacked Warden Stealer (YapStealer) x64 payload extracted from jli.dll loader 8dcf87fa85ae6f9ddf83cd6cf9754d8ddc4f5eb3a2be4f47505b474a934666fc; C2s falaheeh.mom ...
-
web:www.joesandbox.com
Deep Malware Analysis - Joe Sandbox Analysis Report Loading Joe Sandbox Report ... Play interactive tourEdit tour Windows Analysis Report jli.dll.dll
-
web:www.joesandbox.com
The inspected DLL-entry path returns success, while exported functions provide separate execution paths into obfuscated logic. In particular, JLI_Launch at 0x180003259 calls the shared routine at 0x180003ea1. That routine initializes constants, atomically updates a one-time flag, and transfers control through a relative-offset table.
-
web:www.microsoft.com
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
-
web:www.pcrisk.com
WARDEN Stealer is a multi-purpose information stealer, cryptocurrency address clipper, and malware loader built into a single Windows x64 executable. According to research published by KrakenLabs, the threat actor behind WARDEN promotes it on underground forums as a subscription service.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.