🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WARDENStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a
SHA3-384 hash: 896a3e3a60196af5e37f5ee715dccb615b2b90cbace08eac1d887c5d89ab4d97a83354941028a705a01256f0a761469e
SHA1 hash: 0c398348757057419ff0934de37b18e0b10bb7a3
MD5 hash: 4891d35f25e110783444db4f86a89128
humanhash: summer-two-washington-minnesota
File name:jli.dll
Download: download sample
Signature WARDENStealer
Create hunting rule
File size:864'768 bytes
First seen:2026-11-06 21:00:32 UTC
Last seen:2026-11-06 21:25:42 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e8f9c36cfa275538ed766e1c0d7ba623 (1 x WARDENStealer)
ssdeep 24576:NlV61ydiohdbsoozbUNEYKLRH233d5K35USh:3mIwooz0hsRH2PY7
TLSH T19105F181F2450BDECC388AB88D9769435899BC134E514DF7D7EC239B0E71BE4923AB16
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe upx-dec WARDENStealer


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 fed8600a3a6e3e37d389841339c0574a8915e0f10c5725a0d06fc8b63b168c59
File size (compressed) :529'920 bytes
File size (de-compressed) :864'768 bytes
Format:win64/pe
Packed file: fed8600a3a6e3e37d389841339c0574a8915e0f10c5725a0d06fc8b63b168c59

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-11-06 21:05:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eb64724d-523b-4698-81d8-339eda587bbc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97829/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1ba8bac89c90fc65a5008
Tags:
injection virus sage
Gathering data
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a
Verdict:
Malicious
File Type:
dll x64
Link:
https://opentip.kaspersky.com/be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d02a16b8-db7b-4f7e-a2cd-69b3907582ff
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2000155
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contain functionality to detect virtual machines
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Suspicious access to claude desktop data directory by non-Claude process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000155 Sample: jli.dll.exe Startdate: 06/11/2026 Architecture: WINDOWS Score: 100 38 dthousan.forum 2->38 54 Antivirus detection for URL or domain 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Joe Sandbox ML detected suspicious sample 2->58 10 loaddll64.exe 1 2->10         started        signatures3 process4 process5 12 cmd.exe 1 10->12         started        14 rundll32.exe 10->14         started        17 rundll32.exe 10->17         started        19 9 other processes 10->19 signatures6 21 rundll32.exe 12->21         started        68 Contain functionality to detect virtual machines 14->68 70 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 14->70 72 System process connects to network (likely due to code injection or exploit) 17->72 process7 dnsIp8 40 dthousan.forum 104.21.34.215, 443, 49714, 49715 CLOUDFLARENET-CloudflareIncUS Canada 21->40 60 Found many strings related to Crypto-Wallets (likely being stolen) 21->60 62 Tries to harvest and steal ftp login credentials 21->62 64 Tries to harvest and steal browser information (history, passwords, etc) 21->64 66 5 other signatures 21->66 25 chrome.exe 7 21->25         started        signatures9 process10 dnsIp11 42 192.168.2.10 unknown unknown 25->42 44 192.168.2.11 unknown unknown 25->44 46 5 other IPs or domains 25->46 28 chrome.exe 25->28         started        32 chrome.exe 25->32         started        34 chrome.exe 25->34         started        process12 dnsIp13 48 play.google.com 142.251.150.7, 443, 49747 GOOGLE-GoogleLLCUS Canada 28->48 50 www.google.com 142.251.154.119, 443, 49721, 49722 GOOGLE-GoogleLLCUS United States 28->50 52 4 other IPs or domains 28->52 36 Chrome Cache Entry: 157, PDP-11 28->36 dropped file14
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/4891d35f25e110783444db4f86a89128
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a/
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-11-06 21:15:44 UTC
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2orltdz2n77t2f55pz54woj44qqdyuosxttn6kwjwzc7wrk24va._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/261106-ztzrqaszfs/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
cURL User-Agent
Browser Information Discovery
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Badlisted process makes network request
Downloads MZ/PE file
Malware Family:
n/a
Verdict:
Benign
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fb6a1f0b-8868-4dd9-be2a-15928ff71ed8
Malware Family:
yogi
Create hunting rule
Malicious:
True
Tags:
pedll 64bits
Link:
https://intel.virussign.com/intelligence/file/be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a
Unpacked files
SH256 hash:
be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a
MD5 hash:
4891d35f25e110783444db4f86a89128
SHA1 hash:
0c398348757057419ff0934de37b18e0b10bb7a3
Link:
https://www.unpac.me/results/6b86fa71-9dd8-414c-881b-4659a0208896/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:VIGIA_WARDENStealer_8f4ac3a9
Create hunting rule
Rule name:VIGIA_WARDENStealer_ff9da3fc
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:WARDENStealer - evidence-based loader and code indicators
Reference:https://vigia.bisite.es/
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

WARDENStealer

Executable exe fed8600a3a6e3e37d389841339c0574a8915e0f10c5725a0d06fc8b63b168c59

WARDENStealer

Executable exe be9d15cc79d37ff9e8bdebf3de59c9e72101e28e95e736f9564db22fda2ad72a

(this sample)

  
Dropped by
SHA256 fed8600a3a6e3e37d389841339c0574a8915e0f10c5725a0d06fc8b63b168c59
  
Dropped by
MD5 02399546eb5fba4694130c880e23f230
Cape
Cape
https://www.capesandbox.com/analysis/97829/

Comments