MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WARDENStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95
SHA3-384 hash:	0f95499e9ed017daa280567341f9d060cec011681ea07fab55de6ab6dd0fe21f5e84e6630af7653cc3b8b92a2080594d
SHA1 hash:	1be6b0984b918138c99e55c2c25112732919fd4e
MD5 hash:	3f5c9e66e6127ec7623cecfaa2f4a721
humanhash:	ink-jupiter-asparagus-december
File name:	warden_49902b86_unpacked.exe
Download:	download sample
Signature	WARDENStealer Create hunting rule
File size:	483'328 bytes
First seen:	2026-10-17 03:34:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	fed9f6c7ac95fec59e76a01328067a68 (1 x WARDENStealer)
ssdeep	12288:423kLgM5LP+IYT2eWVyenwwiXm/I57y0umw1K:42ULgM5LtYT2eWRwwiXm/I5q
TLSH	T19EA45C03F59580F7D449C431C69B9233AB22FC5BC934BF6B6B945E217EA6B90B728305
TrID	56.2% (.GL) GRASP animation (6508/7/3) 17.3% (.EXE) Generic Win/DOS Executable (2002/3) 17.2% (.EXE) DOS Executable (generic) (2000/1) 8.7% (.SCORE) Music Craft Score (1007/6) 0.2% (.VXD) VXD Driver (29/21)
Magika	pebin
Reporter	Daydream
Tags:	exe stealer unpacked WARDENStealer YapStealer

Daydream

Warden Stealer (YapStealer) x64 payload unpacked from loader 49902b8647bd496b3dd9537bcab438ce9aa31a36faf0b51efab712e09b70d56c. Derived artefact: reconstructed from the loader's in-memory unpacked PE header and section body. Control servers decoded from .rdata single-byte XOR table: mediasource22.com, redlable2.website, redlable1.website.

Intelligence

File Origin

# of uploads :

# of downloads :

202

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-17 03:44:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/eaafa84d-8f41-42ec-92ea-460b21955bf8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92337/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.21774768.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad2ed796f551121ba16a494

Tags:

injection virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug overlay reconnaissance

Link:

https://www.filescan.io/uploads/6ad2ecc0ef418813df472aec/reports/823cecd8-4de7-4ed2-a3b9-c21e4f27f245/overview

Verdict:

Malicious

Labled as:

Win64/Agent_AGeneric.RSR trojan

Link:

https://www.hybrid-analysis.com/sample/bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b4e7bfcb-e4fb-4d14-8cc5-7d6e52e375cf

Score:

41%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/3f5c9e66e6127ec7623cecfaa2f4a721

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95/

Threat name:

Win64.Trojan.Ravartar

Status:

Malicious

First seen:

2026-10-17 03:34:28 UTC

File Type:

PE+ (Dll)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xwiloquqrxwezv5bvnkmy2z6py3etdxbcl6xrdawpfdr5tgftkkq._file

Verdict:

suspicious

Label(s):

WardenStealer

Link:

https://reports.threatray.com/894a3eb1-ed92-4aa5-89cd-bcba3bc0f5e1

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/261017-d4xjfsht6w/

Behaviour

Checks installed software on the system

Unpacked files

SH256 hash:

bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95

MD5 hash:

3f5c9e66e6127ec7623cecfaa2f4a721

SHA1 hash:

1be6b0984b918138c99e55c2c25112732919fd4e

Link:

https://www.unpac.me/results/da2b6344-67ca-463a-a7f6-885696b173fc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bd90b742908dec4cd7a1ab54cc6b3e7e36498ee112fd788c1679471eccc59a95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.