MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Arechclient2

Vendor detections: 6

Intelligence 6 IOCs YARA 26 File information Comments

SHA256 hash:	43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d
SHA3-384 hash:	acd976a8539a6f69887581fb1075de39eb9582ddbddaf5c980537a6fec575c0e85a91f8212fba6c92f1dd26a709192dc
SHA1 hash:	36211488a5592ebf373442d5221f00c2d380ff52
MD5 hash:	f32dd17a62b50ad4b92e4bdde18d92aa
humanhash:	pip-five-yankee-equal
File name:	first.zip
Download:	download sample
Signature	Arechclient2 Create hunting rule
File size:	14'066'490 bytes
First seen:	2026-03-27 21:41:20 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:HkTaqEtT8F/uwik02TC/2EiAkmydBe+DmksnB6ziY1tMdoC/zsRJPWOZ+01cNlK2:aEl8FFik0AyRyPlmujC/zNOZ+cczK2
TLSH	T14CE65A9221C7E1DDD463C13EC94EA5FA919F7CE2C73489D31161BEA63932E82F526B10
Magika	zip
Reporter	aachum
Tags:	5-8-248-245 Arechclient2 dropped-by-ACRStealer HIjackLoader IDATLoader SectopRAT zip

iamaachum

http://185.121.233.94/first.zip

SectopRAT/Arechclient2: 5.8.248.245

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:	CircuitPilot.exe
File size:	11'787'736 bytes
SHA256 hash:	c7b2b382a46fc4b4a08357c9039d515f8efc4503d533d2ade01357baaacfb553
MD5 hash:	44aeba1f361e114ce5eb554db154d4df
MIME type:	application/x-dosexec
Signature	Arechclient2

File name:	cache_mgr.lock
File size:	1'943'446 bytes
SHA256 hash:	41cb83c1243b417957db0ccedfbbfb002d74c4b34a54aa24a629982221ae03da
MD5 hash:	3e8d188c72f1c94f014b9a9bbb92ebe6
MIME type:	application/octet-stream
Signature	Arechclient2

File name:	profilerrelay67.conf
File size:	34'436 bytes
SHA256 hash:	7a2b87e23c367c003984d5c5974aa01828b58e22d0f48d544c34074d24d32126
MD5 hash:	5958e101a8b8540e23e0bc81300cb940
MIME type:	application/octet-stream
Signature	Arechclient2

File name:	amd_ags_x64.dll
File size:	107'520 bytes
SHA256 hash:	e5913bd62d99ac77cbf91d38a0929b07de53d36e9bbcd591512d40ee3da8c3fd
MD5 hash:	a9959568e30c249e3712a40a1a3bdb96
MIME type:	application/x-dosexec
Signature	Arechclient2

File name:	vcomp140.dll
File size:	192'616 bytes
SHA256 hash:	86ce0bad00a31c8b7b64e8cb07ca8a49bba4fc02d339e04eb3ba61a85ec6bf53
MD5 hash:	bb9ebfe6045577d35ec0d592ec8e262f
MIME type:	application/x-dosexec
Signature	Arechclient2

Vendor Threat Intelligence

Malware configuration found for:

HijackLoader

Details

HijackLoader

an XOR key and XOR-decrypted/LZNT1 decompressed component

HijackLoader

embedded components, an injection process, and filepaths

Link:

https://research.acce.ciphertechsolutions.com/results/6c6c22d3-3389-4cfb-a88d-c1858d2f835d/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c6f9bfaacb4c376b14d97f

Tags:

injection obfusc crypt

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto expired-cert fingerprint installer-heuristic keylogger microsoft_visual_cc obfuscated oreans_codevirtualizer overlay packed packed signed

Link:

https://www.filescan.io/uploads/69c6f9b62346b9da57ac1302/reports/be0186d7-3338-403d-8288-3f80f61259db/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d

Verdict:

Unknown

File Type:

zip

First seen:

2026-03-29T03:06:00Z UTC

Last seen:

2026-03-29T03:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d/results?tab=lookup

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Lazarus_Loader_Dec_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect loader used by Lazarus group in december 2020
Reference:	Internal Research

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	CAS_Malware_Hunting Create hunting rule
Author:	Michael Reinprecht
Description:	DEMO CAS YARA Rules for sample2.exe

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.