MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064
SHA3-384 hash:	c7fa2f0cd54cb7871b8bd110fee77f3ec4aacac166056ed16aa0e70a695a856117ca9f59caf14b7f0190987e99cc7346
SHA1 hash:	e5e50ddd26bd0d6b7f92006388e22451a2a202b6
MD5 hash:	9f20fca08728c1d39e9e764433b00b00
humanhash:	missouri-alpha-kitten-illinois
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	12'478'961 bytes
First seen:	2025-10-25 15:24:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:Rn/l/fO6Ux4Hqxl8/zFG9AYy695TL9oIg+bbdiuAr/qPYnsLwgItLXGEOzNVI1pt:rfOhplOM93y6LPyI3WryzMtzGEOcH7Vn
TLSH	T1E8C6333CC0AC359EE833C5B190EE03BAF598771921727CD0ECA1997C76E569AA37419C
Magika	zip
Reporter	aachum
Tags:	46-224-8-58 74a65b ACRStealer Amadey HIjackLoader IDATLoader zip

iamaachum

https://fighthem.space/ => https://mega.nz/file/UVsgwCTb#gNkoY4r_3AZRkk7G89iaPJFz9gj5ObJdeDn6wKK_i7E

ACRStealer C2: 46.224.8.58
Amadey Botnet: 74a65b
Amadey C2: http://mi.overlapsnowbound.com/kaWt2QXfpPueNM/index.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fcebbd6c859164aa646088

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug embarcadero_delphi expired-cert fingerprint invalid-signature overlay packed signed

Link:

https://www.filescan.io/uploads/68fcebb6c85c5c569735df7a/reports/e6943153-acf0-4fef-a978-853e435173c4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064/results?tab=lookup

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.19 SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.28 SOS: 0.29 SOS: 0.31 SOS: 0.34 SOS: 0.37 SOS: 0.40 SOS: 0.43 SOS: 0.46 Zip Archive

Link:

https://app.malva.re/file/9f20fca08728c1d39e9e764433b00b00

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-10-25 15:25:42 UTC

File Type:

Binary (Archive)

Extracted files:

386

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gcjlepqy2ku4hvxqvf2ekvbz27cogsusr2ryaim6usqqg7gcebsa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/3092b23e18d2a9c3d6f0a974455439d7c4e34a928ea380219ea4a1037cc22064