MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WARDENStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 30 File information Comments

SHA256 hash:	5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf
SHA3-384 hash:	5712610ea5eca578bfbaac3627ded959da9468cb88798218d041b1b0cd8e30f82dabb0755c4c79b91518772e6bf5c6a5
SHA1 hash:	428b459b853ff6e597569b5e6a54521aa9bc9064
MD5 hash:	a6d66b4abaca7a4d6ddb7ec96f4df669
humanhash:	mike-tango-lithium-alanine
File name:	x86__setup_now.exe
Download:	download sample
Signature	WARDENStealer Create hunting rule
File size:	15'288'704 bytes
First seen:	2026-11-12 02:44:05 UTC
Last seen:	2026-11-12 03:39:15 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	4f2f006e2ecf7172ad368f8289dc96c1 (184 x SalatStealer, 89 x Vidar, 50 x RemusStealer)
ssdeep	393216:EwT6eVCbs+ijNNcZwjwkoteCrn8tASbTXEKFkH6:FNDVMkotxr8tAkf2a
TLSH	T13CF612077D9082A9C0AA9B3586A78252B631BC88873133D72FD1F7742F76BC15D7AB14
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	aachum
Tags:	exe RemusStealer SpaxMedia WARDENStealer

iamaachum

https://nzqztr2208262ea.cfd/

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-12 02:54:02 UTC

Tags:

golang arch-scr stealer

Link:

https://app.any.run/tasks/fd29e07c-8055-4bca-bb5f-d360e58c8df5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99543/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af52800c48f25399eb5491a

Tags:

injection obfusc virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a process from a recently created file

Searching for synchronization primitives

Creating a window

Sending a custom TCP request

Creating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Query of malicious DNS domain

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 crypto fingerprint golang overlay packed reconnaissance vidar

Link:

https://www.filescan.io/uploads/6af527fbf8c6562344701c0e/reports/2c9f52cb-eb67-4fed-82ef-1c4354486ec8/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf

Malware family:

Warden Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5b0771eb-4b4b-44b7-bf7b-097f58964020

Result

Threat name:

REMUS Stealer, Xmrig

Detection:

malicious

Classification:

phis.troj.spyw.expl.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2004414

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Creates a thread in another existing process (thread injection)

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (creates a PE file in dynamic memory)

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious ZIP file

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Notepad Making Network Connection

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Suricata IDS alerts for network traffic

Suspicious access to claude desktop data directory by non-Claude process

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected REMUS Stealer

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/a6d66b4abaca7a4d6ddb7ec96f4df669

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lxb2tqoujq557modufhbm74nud7zhwxvx5qshrkj4ztojk634c7q._file

Verdict:

malicious

Label(s):

Remus

Link:

https://reports.threatray.com/b20059de-b950-4dab-88da-bf85f50a5c13

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig defense_evasion discovery execution miner persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261112-c79gradw9p/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

cURL User-Agent

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Time Discovery

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Family: xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

Malware Family:

n/a

Verdict:

Suspicious

Tags:

injector

YARA:

command_and_control win_token ParentProcessEvasion HDDInfo_rule UNPROTECT_disable_process

Link:

https://app.threat.zone/submission/59a8f0d5-8bea-43bb-81d1-36e9fd41a547

Malware Family:

wingo

Malicious:

True

Tags:

file-overlay exe 64bit wmi-activity obfuscated persistence

Link:

https://intel.virussign.com/intelligence/file/5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf

Unpacked files

SH256 hash:

5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf

MD5 hash:

a6d66b4abaca7a4d6ddb7ec96f4df669

SHA1 hash:

428b459b853ff6e597569b5e6a54521aa9bc9064

Link:

https://www.unpac.me/results/19b6e361-d6d1-4b86-ad19-08d0f2c1c276/

SH256 hash:

60df6ff437e917c23a41865d9a414824c4ca285fa3347a3aaba8b0f7ce5b4d5a

MD5 hash:

dd28cca02477e7b69d14ba403f21b99d

SHA1 hash:

b8b10661bbca0db8c26424819e943d4b28ff451e

Link:

https://www.unpac.me/results/19b6e361-d6d1-4b86-ad19-08d0f2c1c276/

Malware family:

Remus

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5dc3a9c1d44c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.78

Link:

https://yomi.yoroi.company/submissions/5dc3a9c1d44c3bdfb1c3a14e167f8da0ff93daf5bf6123c549e666e4abdbe0bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	data_manipulation Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RemusStealer_GoPayload Create hunting rule
Author:	burger
Description:	Detects RemusStealer Go-compiled payload

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VIGIA_AokigaharaStealer_01b98ac0 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	AokigaharaStealer - selective string-layout indicators with corroboration
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_WARDENStealer_8f4ac3a9 Create hunting rule

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe