MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569
SHA3-384 hash:	08bd1250cd34c7113cf49931a5f714f827abfd51583bf40b09d8fa42afa634dd8fc448ade2d3e6707081328e27d325c3
SHA1 hash:	03044d9cfab861e9842f07c95f3b0d12b9d19502
MD5 hash:	7352929908929ad0aca013fcfc7584d0
humanhash:	hot-twenty-chicken-nineteen
File name:	SETUP.zip
Download:	download sample
Signature	Amadey Alert Create hunting rule
File size:	20'511'369 bytes
First seen:	2026-03-26 13:25:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:RosDgDJL23mZE7jx3UyzlSGl0eWsdZ26OEh5/iu4FoR5SNQSYs1s1As1O9kZbqnI:RpcDB2WZEPptHFhViuSoku1s1sWsMqUI
TLSH	T1B8273318E93D1744C89F7F389EBC48A3E6B0C3198A77B71DDA1415C82CD3670AB62E16
TrID	46.6% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 35.5% (.XPI) Mozilla Firefox browser extension (8000/1/1) 17.7% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	ACRStealer Amadey dllHijack kl-wholeunfrosted-cfd zip

iamaachum

https://winssoft.org/ => https://mega.nz/file/8nBVmIAA#-OVZKG1cmvdh---_EedfPudCSyMb12F4as6nJACtnOI

ACRStealer C2: kl.wholeunfrosted.cfd

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

242

Origin country :

ES

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/18dfe656-a05a-4fc5-82bc-c17e75198aa5/

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b9b1ce88c80c01586b5fe4

Tags:

infosteal

Hybrid Analysis Trojan.Agent

Verdict:

Suspicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-03-25T12:29:00Z UTC

Last seen:

2026-03-26T14:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569/results?tab=lookup

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Ropalidia

Threat name:

Win32.Trojan.Ropalidia

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-25 19:29:44 UTC

File Type:

Binary (Archive)

Extracted files:

1083

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ugeylzw5hypxldz6fqj5ew7osnvjpq6bvwvs4geutfds7mosvuq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery

Link:

https://tria.ge/reports/260326-r67zvshs2k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e50c4c2f36e9f0fbac79f1609e92df749b54be1e0d6d5970c4a4ca397d8e9569