MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0df6a94057dfad6ec1b8985845d9517ff7c5ac7257fa7eedc0b8a058f7154e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WARDENStealer

Vendor detections: 3

Intelligence 3 IOCs YARA 9 File information Comments

SHA256 hash:	a0df6a94057dfad6ec1b8985845d9517ff7c5ac7257fa7eedc0b8a058f7154e4
SHA3-384 hash:	e9a13e74bba5c68a8c085a9c17253e1f55f12bf8d645d6d4acae2c2fc50db8237f36a134d764d8e57f5052612723cfeb
SHA1 hash:	fcfd6ce62ab608021d1b0265740e185bdedcfeb2
MD5 hash:	b15d80e78194eda4ab583ee9964db193
humanhash:	stream-nuts-august-black
File name:	cx-programmer 9.1 free download full.7z
Download:	download sample
Signature	WARDENStealer Create hunting rule
File size:	15'117'347 bytes
First seen:	2026-10-07 02:53:39 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 1673
ssdeep	393216:GpzfBjXq+VVTrf7CgmXOG9hHvdXPRVqrA47mqmD0e1wisP:Wbz7Czb9hHvZPR8A47o08u
TLSH	T1CDE6330EE86DE25808BF9FE6E0632D47AF528372E3393291359111271DBFBD9B145217
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z file-pumped pw-1673 rogaldorn3-website YapStealer

iamaachum

https://pulse.stellarfluxnode2.cyou/cx-programmer+9.1+free+download+Full.zip

C2: rogaldorn3.website

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 1673

This file archive contains 1 file(s), sorted by their relevance:

File name:	cx-programmer 9.1 free download full.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	956'307'709 bytes
SHA256 hash:	bed62f416dc90be5e0f81688f3519d198b6f6b914a439552573116f5af44ff5b
MD5 hash:	7f956d54e8f2b690a1f4be8beb9ec185
De-pumped file size:	1'053'184 bytes (Vs. original size of 956'307'709 bytes)
De-pumped SHA256 hash:	fed1a1556b70e2d634b05a951a4c5f89617d80e1b1cde5c620f7cf7b2970fdd5
De-pumped MD5 hash:	954d1293832b5296971ed38e973a9203
MIME type:	application/x-dosexec
Signature	YapStealer

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a0df6a94057dfad6ec1b8985845d9517ff7c5ac7257fa7eedc0b8a058f7154e4

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/a0df6a94057dfad6ec1b8985845d9517ff7c5ac7257fa7eedc0b8a058f7154e4/results?tab=lookup

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

7z Archive Archive 7z non extractible (chiffrée, corrompue ou vide) SFX 7z

Link:

https://app.malva.re/file/b15d80e78194eda4ab583ee9964db193

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a0df6a94057dfad6ec1b8985845d9517ff7c5ac7257fa7eedc0b8a058f7154e4/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-07 02:54:33 UTC

File Type:

Binary (Archive)

AV detection:

3 of 23 (13.04%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=udpwvfafpx5nn3a3rgcyixmvc77xywwhev72p3w4bofald3rktsa._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery spyware

Link:

https://tria.ge/reports/261007-e5383abx7y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Time Discovery

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe