MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5
SHA3-384 hash:	088ac233b7382370a0ce4152653c113d9167f3511c318bba668fe02092b4d770123e0b834ceb85c23e0a7f20d986b285
SHA1 hash:	66aaad45e747d48a6e4043d884e02bc12231ac3e
MD5 hash:	bf3231c84eb50b2b48ab77028de023c9
humanhash:	avocado-green-coffee-beer
File name:	Main Setup.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	41'054'699 bytes
First seen:	2026-05-13 02:05:15 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:tU+nUtjIUFvkv82jT/MxoqEo9WZVkD97hbs/j09M:tDUpFvkv1EGqsZa9wjOM
TLSH	T177973385F86DB5A2C3F9E8B47E58652BE220E3B8E1FAA9071D74B11484E33D15700F5B
TrID	66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1) 33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	ACRStealer bitajaxcloud-icu HIjackLoader IDATLoader zip

iamaachum

https://wdnvffur.it.com/ => https://www.mediafire.com/file/vwn3cjsmt4spg2f/D0WNL0AD_SETUP_FILE(KEY_2234).zip/file

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

ES

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/332d7411-66d6-430f-aaee-c5ae203c4090/

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d0532c66ab6d001dce8516

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-05-13T08:06:00Z UTC

Last seen:

2026-05-14T22:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5/results?tab=lookup

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-13 05:49:22 UTC

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=thaiebntb5tquq5cyug6jp5rsvw2v3s2uprjdbb7zsbnryjbz62q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5