MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WARDENStealer

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4
SHA3-384 hash:	ee8e2f25ae88fa9c910f4c33962bd7a17f09fa88fbdc075128647958974ef483617b097dc91229b192dd65b81b46f4ba
SHA1 hash:	1e82581a79e0b3332d2495903416f421976d995a
MD5 hash:	6d3b6fe05798c8c4e8f3e2004d5e5f14
humanhash:	failed-jupiter-chicken-uranus
File name:	Drove.au3
Download:	download sample
Signature	WARDENStealer Create hunting rule
File size:	1'123'729 bytes
First seen:	2026-11-08 02:54:38 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	24576:lw/mlXHyOYa9kdHHZEclaFsNbDgC+KDnUAQaMYMLau00Y:6/mofnd5vaGNbDzzm2B0Y
TLSH	T12C3533B10488596797C6D005D6DEA88405472B6ECE13447DA3286F17E2CAEB633FE1FB
Magika	unknown
Reporter	fbazs
Tags:	a3x AnyPlugins au3 AutoIT fake-plugin Loader LZNT1 process-hollowing

fbazs

AutoIt a3x script dropped by the 7-Zip SFX overlay of vim64.dll (40e9906f017d9285fcd3ef01d5d87d56784350189734ba78f4260227dbe73b2d) and run as "AutoIt3.exe Drove.au3". Decompiles with AutoIt-Ripper.
It decrypts the payload 27eab923aeb79a3054f4677539d9c652c3211e44f251d76347c5ebdfe0333c9f and runs it by process hollowing. 0/71 on VirusTotal at upload.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1bf2eac89c90fc65a677a

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aefe48d82daf0d0b693e048/reports/d849b9fe-eeb5-4204-982e-094d5a3b64ea/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4

Verdict:

Clean

File Type:

unknown

Link:

https://opentip.kaspersky.com/3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-11-06 08:23:41 UTC

File Type:

Binary

AV detection:

4 of 22 (18.18%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gwjpihjo2pjsd2pru56guljz2oicmtxeo6ye5m7wlx65xcxxvs2a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/3592f41d2ed3d321e9f1a77c6a2d39d390264ee477b04eb3f65dfddb8af7acb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.