MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Arechclient2

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246
SHA3-384 hash:	c4be999a5261a1666189a6144e0de85811513bd966e61b9a05063fd9f3295db0d98199ac2f049dece3eed0b6645d9f23
SHA1 hash:	a9e7e542bcf0e47ba3f7b95c08f01d4b0701f315
MD5 hash:	f426f208e0864e445a89d8fd24a47c64
humanhash:	cardinal-nevada-cat-lemon
File name:	GARDEN.ps1
Download:	download sample
Signature	Arechclient2 Create hunting rule
File size:	1'096'950 bytes
First seen:	2026-04-04 01:44:12 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:pRCoRCHoINtFPc+4nB82SvjM6FWC7PtwJg9hn4oziwjg:pUHFL+BLSv3WC7yg92oeb
TLSH	T184356A375D470F7B42C933DAEE936545EE25515A12B322BC3BAEE064370BE5C6B8884C
Magika	powershell
Reporter	aachum
Tags:	178-16-54-51 91-92-240-16 Arechclient2 dropped-by-LummaStealer ps1 SectopRAT

iamaachum

https://enotmoneti.pw/GARDEN

Arechclient2/SectopRAT C2:
91.92.240.16:443
178.16.54.51:443

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d066d966ab6d001dce8dba

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

encrypted powershell

Link:

https://www.filescan.io/uploads/69d06cef972c219c8d778945/reports/5d4c994f-0adb-4040-ba39-9821c06210c0/overview

Verdict:

Malicious

Labled as:

PowerShell/Agent.DYW trojan

Link:

https://www.hybrid-analysis.com/sample/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-03T22:25:00Z UTC

Last seen:

2026-04-05T17:44:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.PowerShell.Obfus.gen

Link:

https://opentip.kaspersky.com/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1893400

Signature

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246

Verdict:

inconclusive

YARA:

2 match(es)

Link:

https://app.malva.re/file/f426f208e0864e445a89d8fd24a47c64

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246/

Verdict:

Malicious

Threat:

Family.ARECHCLIENT2

Link:

https://tip.neiki.dev/file/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jjr3bilstag77gfuwg6y5mm7dlo55mmsaatvc5oxf3byc7iv4jda._file

Result

Malware family:

sectoprat

Score:

10/10

Tags:

family:sectoprat discovery execution persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/260404-b5yf2adt4r/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Time Discovery

Drops file in Windows directory

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Badlisted process makes network request

SectopRAT

SectopRAT payload

Sectoprat family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)