🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WARDENStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 55 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af
SHA3-384 hash: 9a570fe66954ad25a8d07e4516f0f77bfac76a647cddbb492d83e4e74291132b18b2a8659202515ff8125262f0258346
SHA1 hash: 08f744c8888214c1a39545f9352aa00e4561bec6
MD5 hash: a2e73a64aea662418eda2e7a6aef0934
humanhash: north-potato-green-solar
File name:application_patched.exe
Download: download sample
Signature WARDENStealer
Create hunting rule
File size:32'926'720 bytes
First seen:2026-11-01 00:04:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 8b98e4c440ad72f1e7a323e85897fd47 (2 x WARDENStealer)
ssdeep 393216:YAr+eOX4iIJ3VY4HiFxxm16GiCuN+U+lIkksFh/GZ:YAr+eOX4iIJFGF616F9+lI7mheZ
TLSH T11C77BE01B7D84471E2FB2634257AA7365A7EBD301FA082CB275467AE2C717C19E3076B
TrID 49.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
19.4% (.EXE) Win64 Executable (generic) (6522/11/2)
13.4% (.EXE) Win32 Executable (generic) (4504/4/1)
6.0% (.EXE) OS/2 Executable (generic) (2029/13)
5.9% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon d4aeeee8cccce0d4 (2 x WARDENStealer)
Reporter aachum
Tags:de-pumped exe WARDENStealer


Avatar
iamaachum
https://pulse.hyperbyteworks8.lol/Recuva_Professional__Technician_(2026)_Full_Espa%C3%B1ol_%5BMega%5D.zip.zip => https://dwn.ciphermatrix2.lol/e/get/hHl2TeaekrKWzP2QjMMbIF25/application.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
PT PT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0fd69627-b9c2-460d-9999-29f58f3b749e/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-11-01 00:14:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d5598dc4-7c4b-489b-a98b-7fab16a6a4f1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae682f4b175ade21dced147
Tags:
injection emotet obfusc virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context ai-borne anti-debug crypto installer-heuristic llm-interaction masquerade microsoft_visual_cc overlay packed packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6ae6823f0fa2451321ee7c15/reports/17bbe21b-f6c6-49a1-b92f-60ed3f735b6f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-31T23:11:00Z UTC
Last seen:
2026-11-02T19:56:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1995953
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Suspicious access to claude desktop data directory by non-Claude process
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995953 Sample: application_patched.exe Startdate: 01/11/2026 Architecture: WINDOWS Score: 100 31 aqringagook.website 2->31 37 Multi AV Scanner detection for submitted file 2->37 39 Joe Sandbox ML detected suspicious sample 2->39 8 explorer.exe 30 7 2->8 injected 12 application_patched.exe 2->12         started        signatures3 process4 dnsIp5 33 aqringagook.website 104.21.21.247, 443, 49707, 49708 CLOUDFLARENET-CloudflareIncUS Canada 8->33 41 System process connects to network (likely due to code injection or exploit) 8->41 43 Tries to steal Mail credentials (via file / registry access) 8->43 45 Found many strings related to Crypto-Wallets (likely being stolen) 8->45 55 5 other signatures 8->55 14 chrome.exe 3 8->14         started        47 Injects code into the Windows Explorer (explorer.exe) 12->47 49 Writes to foreign memory regions 12->49 51 Allocates memory in foreign processes 12->51 53 Creates a thread in another existing process (thread injection) 12->53 signatures6 process7 dnsIp8 35 192.168.2.4, 138, 443, 49697 unknown unknown 14->35 17 chrome.exe 14->17         started        21 chrome.exe 14->21         started        process9 dnsIp10 25 mobile-gtalk.l.google.com 142.250.9.188, 49733, 5228 GOOGLE-GoogleLLCUS United States 17->25 27 play.google.com 142.251.155.7, 443, 49735 GOOGLE-GoogleLLCUS United States 17->27 29 3 other IPs or domains 17->29 23 Chrome Cache Entry: 99, PDP-11 17->23 dropped file11
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af
Gathering data
Threat name:
Win64.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 00:05:26 UTC
File Type:
PE+ (Exe)
Extracted files:
13
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=budr5lw6sgumghp6l6rfqwpjittc5ft5ninbgfvzqrlxrnp6hcxq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/261101-adb82sst5q/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d071eaede91/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_Dlls
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FormhookB
Create hunting rule
Author:kevoreilly
Description:Formbook Anti-hook Bypass
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:MULTI_Famille_837ffd60
Create hunting rule
Author:Marjoriefort
Description:Famille MULTI_Famille_837ffd60 - noyau stable de 3 membre(s) ; identifiants randomises exclus (synthese v1.9.2)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_0507f067_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat script)
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:test_rule_vldslv
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VIGIA_WARDENStealer_8f4ac3a9
Create hunting rule
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_BlakcSeeStealer_ForgeAuto_9b0a0e39_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects BlakcSeeStealer (pe, etat extrait)
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd
Create hunting rule
Author:Marjoriefort
Description:Detects PythonStealer (pe, etat binaire)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Sliver_ForgeAuto_2ddb463c
Create hunting rule
Author:Marjoriefort
Description:Detects Sliver (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3be2a519
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_43faefd2
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_b550d7b4_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_f1079127
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

WARDENStealer

7z 14dc82bc5ee7c606e862a702666cc1b314179545f3a56fa68fc76b29d5900576

WARDENStealer

Executable exe 0d071eaede91a8c31dfe5fa25859e944e62e967d6a1a1316b9845778b5fe38af

(this sample)

  
Link
https://tria.ge/261031-21z26sey3x/behavioral2
  
Dropped by
SHA256 14dc82bc5ee7c606e862a702666cc1b314179545f3a56fa68fc76b29d5900576
  
Delivery method
Distributed via web download
  
Dropped by
MD5 1f2b58f4c0908f46a9d119be4e376740

Comments