MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21
SHA3-384 hash:	b4559b85b0aca1c271909362b62b3a93d2c8424ff1ae8ac1cac651b41ca40b5ff03d05d566e25fbabd1f5b696bad6468
SHA1 hash:	73d330be08cb9986defe3175b8116d4a22bf279c
MD5 hash:	1af76ef8857935eb1d8e46dc9cfe3729
humanhash:	virginia-east-pip-maine
File name:	xf-mccs6.exe
Download:	download sample
File size:	87'040 bytes
First seen:	2026-11-09 08:21:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	c7aaeea671e489e6c9e04d34e80606c1
ssdeep	1536:dYXmTrBviuTlhRFZD4eU8DcHaEDo7Ly6Sy6BxBnQbvM3fnouy8I5:dYXYrhhp1ZDLtGto3g2KPoutI
TLSH	T173830122DDA30B60DA5B81751045FBB6A950DD1A4A93CE03AFD63D7BF52BB183CA401D
TrID	34.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 34.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.7% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	026c587072444751 (1 x LummaStealer)
Reporter	malwaress
Tags:	exe keygen UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	87'040 bytes
File size (de-compressed) :	338'944 bytes
Format:	win32/pe
Unpacked file:	2c128cf07557c1570c8d6bf7011b8f65c35398edf4197c3b9a631aeb16b7c106

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5ed57df0-be95-4d43-86e3-c31bf9216b8d/

Malware family:

n/a

ID:

File name:

Crack Ottimo.zip

Verdict:

No threats detected

Analysis date:

2026-11-06 20:50:05 UTC

Tags:

arch-exec arch-doc upx

Link:

https://app.any.run/tasks/454b89ab-e97a-4813-a044-2a7735be3de0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/98405/

Detection(s):

Win.Tool.Genkryptik-9939783-0

Win.Trojan.Keygen-522

Win.Trojan.Keygen-523

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c67c1492c978625a70df

Tags:

applicunsaf virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

Win/grayware_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21

Verdict:

Unknown

File Type:

exe x32

First seen:

2012-06-29T18:45:00Z UTC

Last seen:

2026-11-04T03:35:00Z UTC

Hits:

~100000

Link:

https://opentip.kaspersky.com/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/eaa22e5a-5c3a-46db-9f29-8ecb75e5157c

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1303246

Signature

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout UPX Win 32 Exe x86

Link:

https://app.malva.re/file/1af76ef8857935eb1d8e46dc9cfe3729

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21/

Threat name:

Win32.Hacktool.Generic

Status:

Suspicious

First seen:

2012-07-01 10:40:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vqwupxbngptbepnb6ovqb7vdufszzyhuojtmzgvqat5exai7hmqq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/261109-j9q7hsa19t/

Behaviour

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

UPX packed file

Malware Family:

n/a

Verdict:

Benign

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/44fd27d7-ac15-4bd0-a06c-29e73a2ceb22

Malware Family:

keygen

Malicious:

True

Tags:

input-check upx polymorphic peexe

Link:

https://intel.virussign.com/intelligence/file/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21

Unpacked files

SH256 hash:

ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21

MD5 hash:

1af76ef8857935eb1d8e46dc9cfe3729

SHA1 hash:

73d330be08cb9986defe3175b8116d4a22bf279c

Link:

https://www.unpac.me/results/9a4f2294-32c1-413f-9509-0d9b1ca9386e/

SH256 hash:

2c128cf07557c1570c8d6bf7011b8f65c35398edf4197c3b9a631aeb16b7c106

MD5 hash:

8c8b7ae2a0933b1830e0fb83730f233e

SHA1 hash:

28bcdf2c38356abff5437c4a130e8cde832b401e

Link:

https://www.unpac.me/results/9a4f2294-32c1-413f-9509-0d9b1ca9386e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.