MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WARDENStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21
SHA3-384 hash:	fa4886fffe6fa4c56066275ed3eba12698fa7eb8f60f1df15d292e126730939363cc05c8ae7edd9aaf3c282e825e0d36
SHA1 hash:	bdde56eab8a97296ccc8f005cd88b4cfa9eaa0b4
MD5 hash:	693e93d5d5a4693fa58aabc71ea2a074
humanhash:	arkansas-north-florida-hawaii
File name:	glaicer.exe
Download:	download sample
Signature	WARDENStealer Create hunting rule
File size:	487'936 bytes
First seen:	2026-11-14 15:23:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	30dacba1dcd6da1a77e8921c33411e93 (1 x WARDENStealer)
ssdeep	12288:qr03yEou0LfPaiWkDmHchVKyrG7L8052T:L0ZphVfGf5C
TLSH	T1D8A423DAA6DD9638FC1CDF7B502958427D31F8067DA12B1DC10C19AE3F6B6A0C682736
TrID	33.6% (.EXE) OS/2 Executable (generic) (2029/13) 33.1% (.EXE) Generic Win/DOS Executable (2002/3) 33.1% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	28126965654d0200 (3 x WARDENStealer)
Reporter	AmadeyHunter
Tags:	exe stealer UPX Warden WARDENStealer

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	487'936 bytes
File size (de-compressed) :	806'912 bytes
Format:	win64/pe
Unpacked file:	52af906ca0e69f2be68ff7393f929b89d42c9d578a8481d962241fb8ac9d319c

Intelligence

File Origin

# of uploads :

# of downloads :

188

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8a7010ac-b02e-4008-a9d1-9bf261efb877/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-11-14 15:25:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7538736f-6867-4a09-beb5-77fa30b0451e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/100041/

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af87d1afc945c1ebf2a1452

Tags:

cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Program Files subdirectories

Creating a window

Searching for synchronization primitives

Launching a service

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug fingerprint masquerade packed packed packed packer reconnaissance upx

Link:

https://www.filescan.io/uploads/6af87d9f6f82f229954c9691/reports/9ac67d69-42bf-4b10-9138-6bd403ff1658/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/97e2ad10-26f0-4536-a36c-df2896bd1f1c

Result

Threat name:

Warden Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2006028

Signature

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Warden Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout UPX Win 64 Exe x64

Link:

https://app.malva.re/file/693e93d5d5a4693fa58aabc71ea2a074

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wof4hx3p7cyav24xnsamiepahoybouuz6efh5i3og2icofjpv4qq._file

Verdict:

malicious

Label(s):

WardenStealer

Link:

https://reports.threatray.com/df5a35f9-7661-4a4b-a9ce-12a4dee6817f

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery spyware upx

Link:

https://tria.ge/reports/261114-ss4wqaez5l/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Drops file in Program Files directory

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Malware Family:

n/a

Verdict:

Suspicious

Tags:

injector

YARA:

n/a

Link:

https://app.threat.zone/submission/4028a6a8-3c95-43c2-a766-7cf4eae39a9e

Malware Family:

khqy

Malicious:

True

Tags:

64bit exe upx file-corrupted

Link:

https://intel.virussign.com/intelligence/file/b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21

Unpacked files

SH256 hash:

b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21

MD5 hash:

693e93d5d5a4693fa58aabc71ea2a074

SHA1 hash:

bdde56eab8a97296ccc8f005cd88b4cfa9eaa0b4

Link:

https://www.unpac.me/results/f3a1e55d-0815-4a1b-88b4-6a13a2f1a476/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b38bc3df6ff8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.