MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adcce84b96eaa1dbf470f703be4bf56be7eb107f6e10d0127b81228bf00a8758. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZigClipper

Vendor detections: 5

Intelligence 5 IOCs YARA 22 File information Comments

SHA256 hash:	adcce84b96eaa1dbf470f703be4bf56be7eb107f6e10d0127b81228bf00a8758
SHA3-384 hash:	6cb9be04537a051d41c4c5b424f86cf3f47fa95c4b2cc4358e13823d5cb83db488a780432f386f1620e9df88d92e1ddf
SHA1 hash:	ad55b4213faf5f61cdb8517831cb34be49fae305
MD5 hash:	70178e98cfc55a3f38761d8682b9aa62
humanhash:	shade-bulldog-three-lamp
File name:	1f86ed90-6b0e-41e4-b4b8-dee23cfba442.zip
Download:	download sample
Signature	ZigClipper Create hunting rule
File size:	9'648'738 bytes
First seen:	2026-03-26 13:40:50 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:HBVT5+uWL63x+mb2ZYYLUIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc92PZ84k:h+L63Mmb21YhOnn7FUNyhGprLz0Uh8Z
TLSH	T1F6A633E0F1846FC1E131C57153F890E6E6DE28756093DC62B8231B8E6593AF3A7AF845
Magika	zip
Reporter	aachum
Tags:	dropped-by-ACRStealer smart-hugo-mapp-co ZigClipper zip

iamaachum

https://cdn-1415.brightcanvas.digital/1f86ed90-6b0e-41e4-b4b8-dee23cfba442

C2: https://smart.hugo-mapp.co/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 19 file(s), sorted by their relevance:

File name:	vcruntime140_1.dll
File size:	49'776 bytes
SHA256 hash:	6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 hash:	c0c0b4c611561f94798b62eb43097722
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	_asyncio.pyd
File size:	78'680 bytes
SHA256 hash:	0f42466dc4974071a14a6e79257fcd5b3b09b6f826f2ed3a5f18e7f50c267ea0
MD5 hash:	4a46772e8a5da74f7c7243757c3bf880
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	_ctypes.pyd
File size:	143'192 bytes
SHA256 hash:	3d96bd2fcceac4b94aa4c39a2c28117b67fdef2efb85e8c70153a42232a993f3
MD5 hash:	4c2b30ea5dde6369c5e2f757ca4a42c1
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	_queue.pyd
File size:	36'696 bytes
SHA256 hash:	8175bc5ba1d0a593972ddfee43df20c43f8a31a5002d7b9a4709ca3eafd7e9d7
MD5 hash:	14c76669397f108de22e12f6b1cde2c8
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	python315._pth
File size:	80 bytes
SHA256 hash:	c7f3432f90e8f04c78ff2cef76cf51e50a13ed922f0bcc63fa34aa4decc5770c
MD5 hash:	226b7a3e899ba566037018eca15b58f4
MIME type:	text/x-objective-c
Signature	ZigClipper

File name:	_hashlib.pyd
File size:	71'512 bytes
SHA256 hash:	26e11f41bf2197c007ccb57dc98d939dd409c0c3d8de77b31e19943f772ee8f8
MD5 hash:	cbaeac105368d515a4d1a6940dfbb1da
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	libffi-8.dll
File size:	39'696 bytes
SHA256 hash:	eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 hash:	0f8e4992ca92baaf54cc0b43aaccce21
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	python3.dll
File size:	75'096 bytes
SHA256 hash:	482b1c87a8bdd8770ec81f4b0e236de21b5cf3d45a549dc0b051b09732a99dbe
MD5 hash:	f1c0a4a859622f79c0fa559196b3e693
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	FNPLicensingService.exe
File size:	104'792 bytes
SHA256 hash:	b35f09b876edb18695347860f79acddc68993f711274556156769476cd05ae8a
MD5 hash:	e961458d3d879ad7f1f19c99962045a7
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	_multiprocessing.pyd
File size:	38'744 bytes
SHA256 hash:	a978a37b0ea079253cc7768d2418510c4c6841a8c3349219d159864ce0d09dd1
MD5 hash:	3187801d7f0b2cbb831b75d763592794
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	vcruntime140.dll
File size:	120'400 bytes
SHA256 hash:	052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 hash:	32da96115c9d783a0769312c0482a62d
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	node_modules.asar
File size:	500'360 bytes
SHA256 hash:	054fb3498e767299600aa0ebcd8244b91f60d77d337aaa5b1e20a183d6a6509f
MD5 hash:	34056ebf13095e107b6fe24b7a292899
MIME type:	text/x-python
Signature	ZigClipper

File name:	_overlapped.pyd
File size:	58'200 bytes
SHA256 hash:	0ad47d7781743749a70d628deb38b2bfece3befb5b5c62ed1efdbe25a9fe4cef
MD5 hash:	53fe605e5b27c4a8d882fa3602ca33a8
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	python315.zip
File size:	4'655'786 bytes
SHA256 hash:	0e029c316b6bc7931064a1b5dd2f18213a0581bf447fffbbf687e6cca573aa21
MD5 hash:	d6e54e53978b3d55671595687d974681
MIME type:	application/zip
Signature	ZigClipper

File name:	select.pyd
File size:	33'624 bytes
SHA256 hash:	65d39f525db6a75c16b2b964db3980b9ba7ec6516fd1fcfd837b11e5c6dec58f
MD5 hash:	05ec06c185b17804418ccc3499dabe60
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	sqlite3.dll
File size:	1'584'984 bytes
SHA256 hash:	87c6b978c344588a467f85b90cc8b08a43f85af0fba63f7e8b2acb020ea32624
MD5 hash:	dd46150db2866c834c57ef43c3d73ad2
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	python315.dll
File size:	7'210'840 bytes
SHA256 hash:	46d30acdb729ca35aefeac6e5ab5e00cf8c2ec823e922e8aebe82a412e832336
MD5 hash:	1d42f83fa0e0d4b7fa3b1373106e20ad
MIME type:	application/x-dosexec
Signature	ZigClipper

File name:	python.cat
File size:	614'070 bytes
SHA256 hash:	8e433df6ab86d23d5b7d60e175f9242e3c780db2371c92f56ecc8e2eaa7ccc9b
MD5 hash:	27f7d8bde8f8b77d180e63d04398357e
MIME type:	application/octet-stream
Signature	ZigClipper

File name:	unicodedata.pyd
File size:	771'416 bytes
SHA256 hash:	ab9887db8cc2bf76a91e7e17bc59b94a6771c6c4e7223142f352006d8131f9d7
MD5 hash:	574e55857a21fe3a4a4afb2edab6ca47
MIME type:	application/x-dosexec
Signature	ZigClipper

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/02f43d08-d79e-45dc-aa02-09b4bd46af1f/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694ef6b1038f10550b5621f3

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/adcce84b96eaa1dbf470f703be4bf56be7eb107f6e10d0127b81228bf00a8758

Verdict:

Unknown

File Type:

zip

First seen:

2026-03-26T08:54:00Z UTC

Last seen:

2026-03-26T14:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/adcce84b96eaa1dbf470f703be4bf56be7eb107f6e10d0127b81228bf00a8758/results?tab=lookup

Score:

30%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260326-r7v2paby8s/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/adcce84b96eaa1dbf470f703be4bf56be7eb107f6e10d0127b81228bf00a8758

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAS_Malware_Hunting Create hunting rule
Author:	Michael Reinprecht
Description:	DEMO CAS YARA Rules for sample2.exe

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.