MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Arechclient2

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
SHA3-384 hash:	8750c255abc048c3202a4be6b991de6fa8aece35e37bd6e67b98a68b376447f5c66e5e05c67564bbd72ccfb11214a12c
SHA1 hash:	fe8fb752581ffea530e67db2b638491e38f59343
MD5 hash:	a949348dd547855fdb650e004fe0f5e1
humanhash:	nebraska-texas-aspen-seven
File name:	Fabrics.a3x
Download:	download sample
Signature	Arechclient2 Create hunting rule
File size:	1'271'880 bytes
First seen:	2026-09-25 23:21:36 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH	T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
Magika	unknown
Reporter	aachum
Tags:	178-104-144-200 a3x Arechclient2 AsgardProtector dropped-by-ACRStealer SectopRAT

iamaachum

https://metrics.agoxpathbet.one/Fabrics.a3x

Arechclient2/SectopRAT C2: 178.104.144.200

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ab7651a3c24eb647cea757b/reports/f2e4e72e-8a66-4a1f-82e1-074237152cdf/overview

Verdict:

Unknown

File Type:

unknown

First seen:

2026-09-26T10:11:00Z UTC

Last seen:

2026-09-27T17:42:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc/results?tab=lookup

Gathering data

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-26 02:22:52 UTC

File Type:

Binary

AV detection:

3 of 38 (7.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cfrqq47teldyrvnyzppcn2jbjphneh22hmyxujjj6axhzdlvnxoa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.