Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis.
It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low.
Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.
