MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573
SHA3-384 hash:	0abfe72dc939707c1a297cbfcec3b4a6f4bdb2c3af2e21815e003d0428c8bb751836b0dbafdf53ffe4f96f5aeb1e2728
SHA1 hash:	a6f59489d57def1d32d7e40025263170767cd1af
MD5 hash:	97679b1291ee9e51e0ab025eb5f3d5e9
humanhash:	minnesota-sixteen-oscar-monkey
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	12'476'069 bytes
First seen:	2025-10-27 14:58:27 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:fbdvLhzadXtJGIjla+ANFHk5lkEQMwSVTYQa/oduUZWrcGgB23xMo/KXp/TZx:jdvLhzGXycM9k5lj4Q0UZNo/KXp/TD
TLSH	T1CFC6334D82BD71EDE13047F875A38A9194192B35DAB8C79E4BE0072B96CF4DAC8533C9
Magika	zip
Reporter	aachum
Tags:	46-224-8-58 74a65b ACRStealer Amadey HIjackLoader IDATLoader zip

iamaachum

https://fighthem.space/ => https://mega.nz/file/EYcBFIYI#NBoRGUpeJXjZ4HEfZBy0Euc_8ReBAumk7fuVlPg_a6M

ACRStealer C2: 46.224.8.58
Amadey Botnet: 74a65b
Amadey C2: http://mi.overlapsnowbound.com/kaWt2QXfpPueNM/index.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

154

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fcebbd6c859164aa646088

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug embarcadero_delphi expired-cert fingerprint invalid-signature overlay packed signed

Link:

https://www.filescan.io/uploads/68ff88af3a79800405f8c33f/reports/24ccd6a0-b3c0-4e92-8692-2cfa62c55e1d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573/results?tab=lookup

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.19 SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.28 SOS: 0.29 SOS: 0.31 SOS: 0.34 SOS: 0.37 SOS: 0.40 SOS: 0.43 SOS: 0.46 Zip Archive

Link:

https://app.malva.re/file/97679b1291ee9e51e0ab025eb5f3d5e9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573/

ReversingLabs TitaniumCloud Win32.Trojan.Hijackloader

Threat name:

Win32.Trojan.Hijackloader

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-10-27 15:01:25 UTC

File Type:

Binary (Archive)

Extracted files:

386

AV detection:

20 of 38 (52.63%)

Threat level:

  5/5

Hatching Triage hijackloader

Result

Malware family:

hijackloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:hijackloader defense_evasion discovery execution spyware trojan

Link:

https://tria.ge/reports/251027-tnabzsgr9y/

Behaviour

Command and Scripting Interpreter: JavaScript

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.50

Link:

https://yomi.yoroi.company/submissions/258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573