MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4
SHA3-384 hash:	308f4af341208aae80227aaca7548954b1f3835fdbadd4ac7434d97a07d6c9fad1f1e6c6b208e8a4ebe74833c0a6c4b9
SHA1 hash:	458d3d0c2db4e190f59a340e04238f1f6a8e8c6a
MD5 hash:	90d1190e5e010c1fa6dfcdc08615a5fa
humanhash:	iowa-rugby-hawaii-fanta
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	18'430'481 bytes
First seen:	2026-07-04 03:42:21 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:GoMqq+g+jRcQ3ctO1D8FPEB+Jnl7DeUpHesS8Y2nv:Dq/0d3ctOwMUJnl7Dew/YIv
TLSH	T1300722A9663D341BF8D09FFD54A638CC1163399818612F2B8F6F04B1F6737297C66862
Magika	zip
Reporter	aachum
Tags:	ACRStealer stream-pawpalace-cc zip

iamaachum

https://btoonnyt.com/ => https://www.mediafire.com/file/a0gtgj26kis9wes/SETUP_ARCHIVE_(KEY=4082).zip/file

ACRStealer C2: stream.pawpalace.cc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

ES

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f8c93375-95c8-49d5-a864-dd925176a970/

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a488242762b0b26f3cf94b1

Tags:

malware

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4/results?tab=lookup

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4/

ReversingLabs TitaniumCloud Binary.Trojan.Generic

Threat name:

Binary.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-03 05:20:02 UTC

File Type:

Binary (Archive)

Extracted files:

761

AV detection:

5 of 36 (13.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3hlfxkindsztt275u65j6qrmi5pv64z7j3vp4tn5xc3gnq6cml2a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

adware discovery persistence ransomware revoked_codesign spyware

Link:

https://tria.ge/reports/260704-hw8nzagv5j/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d9d65ba90d1cb339ebfda7ba9f422c475f5f733f4eeafe4dbdb8b666c3c262f4