MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9
SHA3-384 hash: 391b8fb9872dfe39afd4c4952aeb709f7a240f2abe7b9ce42d6531a0d5062088d6ab797703f2a95bc78efa07ae0a045b
SHA1 hash: e4cfe475742ee52dc1d3ba9b1cc106b0cad1ea80
MD5 hash: b300ced4550e23bf3712d825095ac4f5
humanhash: stream-saturn-zulu-sink
File name:kfhogts.zip
Download: download sample
File size:9'525'729 bytes
First seen:2026-03-07 14:26:30 UTC
Last seen:2026-04-01 11:09:24 UTC
File type: zip
MIME type:application/zip
ssdeep 196608:y5+uWL63x+mb2ZYYLyIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9CPZ8K7//4:zL63Mmb21uhOnn7FUNyhGprLz0gh8OQ
TLSH T16EA633E0F584AFC1D121D93153F880A5FADE18666093DC62BC132F9E65936F3B7AE448
Magika zip
Reporter aachum
Tags:dropped-by-ACRStealer teampcp zip


Avatar
iamaachum
http://185.242.3.239/kfhogts

Intelligence

File Origin
# of uploads :
2
# of downloads :
140
Origin country :
ES ES
File Archive Information

This file archive contains 20 file(s), sorted by their relevance:

File name:vcruntime140_1.dll
File size:49'776 bytes
SHA256 hash: 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 hash: c0c0b4c611561f94798b62eb43097722
MIME type:application/x-dosexec
File name:_asyncio.pyd
File size:78'680 bytes
SHA256 hash: 0f42466dc4974071a14a6e79257fcd5b3b09b6f826f2ed3a5f18e7f50c267ea0
MD5 hash: 4a46772e8a5da74f7c7243757c3bf880
MIME type:application/x-dosexec
File name:_ctypes.pyd
File size:143'192 bytes
SHA256 hash: 3d96bd2fcceac4b94aa4c39a2c28117b67fdef2efb85e8c70153a42232a993f3
MD5 hash: 4c2b30ea5dde6369c5e2f757ca4a42c1
MIME type:application/x-dosexec
File name:_queue.pyd
File size:36'696 bytes
SHA256 hash: 8175bc5ba1d0a593972ddfee43df20c43f8a31a5002d7b9a4709ca3eafd7e9d7
MD5 hash: 14c76669397f108de22e12f6b1cde2c8
MIME type:application/x-dosexec
File name:_hashlib.pyd
File size:71'512 bytes
SHA256 hash: 26e11f41bf2197c007ccb57dc98d939dd409c0c3d8de77b31e19943f772ee8f8
MD5 hash: cbaeac105368d515a4d1a6940dfbb1da
MIME type:application/x-dosexec
File name:libffi-8.dll
File size:39'696 bytes
SHA256 hash: eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 hash: 0f8e4992ca92baaf54cc0b43aaccce21
MIME type:application/x-dosexec
File name:python3.dll
File size:75'096 bytes
SHA256 hash: 482b1c87a8bdd8770ec81f4b0e236de21b5cf3d45a549dc0b051b09732a99dbe
MD5 hash: f1c0a4a859622f79c0fa559196b3e693
MIME type:application/x-dosexec
File name:FNPLicensingService.exe
File size:104'792 bytes
SHA256 hash: b35f09b876edb18695347860f79acddc68993f711274556156769476cd05ae8a
MD5 hash: e961458d3d879ad7f1f19c99962045a7
MIME type:application/x-dosexec
File name:_multiprocessing.pyd
File size:38'744 bytes
SHA256 hash: a978a37b0ea079253cc7768d2418510c4c6841a8c3349219d159864ce0d09dd1
MD5 hash: 3187801d7f0b2cbb831b75d763592794
MIME type:application/x-dosexec
File name:vcruntime140.dll
File size:120'400 bytes
SHA256 hash: 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 hash: 32da96115c9d783a0769312c0482a62d
MIME type:application/x-dosexec
File name:_overlapped.pyd
File size:58'200 bytes
SHA256 hash: 0ad47d7781743749a70d628deb38b2bfece3befb5b5c62ed1efdbe25a9fe4cef
MD5 hash: 53fe605e5b27c4a8d882fa3602ca33a8
MIME type:application/x-dosexec
File name:sqlite3.dll
File size:1'584'984 bytes
SHA256 hash: 87c6b978c344588a467f85b90cc8b08a43f85af0fba63f7e8b2acb020ea32624
MD5 hash: dd46150db2866c834c57ef43c3d73ad2
MIME type:application/x-dosexec
File name:select.pyd
File size:33'624 bytes
SHA256 hash: 65d39f525db6a75c16b2b964db3980b9ba7ec6516fd1fcfd837b11e5c6dec58f
MD5 hash: 05ec06c185b17804418ccc3499dabe60
MIME type:application/x-dosexec
File name:python315.dll
File size:7'210'840 bytes
SHA256 hash: 46d30acdb729ca35aefeac6e5ab5e00cf8c2ec823e922e8aebe82a412e832336
MD5 hash: 1d42f83fa0e0d4b7fa3b1373106e20ad
MIME type:application/x-dosexec
File name:python.cat
File size:614'070 bytes
SHA256 hash: 8e433df6ab86d23d5b7d60e175f9242e3c780db2371c92f56ecc8e2eaa7ccc9b
MD5 hash: 27f7d8bde8f8b77d180e63d04398357e
MIME type:application/octet-stream
File name:unicodedata.pyd
File size:771'416 bytes
SHA256 hash: ab9887db8cc2bf76a91e7e17bc59b94a6771c6c4e7223142f352006d8131f9d7
MD5 hash: 574e55857a21fe3a4a4afb2edab6ca47
MIME type:application/x-dosexec
File name:python315._pth
File size:80 bytes
SHA256 hash: c7f3432f90e8f04c78ff2cef76cf51e50a13ed922f0bcc63fa34aa4decc5770c
MD5 hash: 226b7a3e899ba566037018eca15b58f4
MIME type:text/x-objective-c
File name:python315.zip
File size:4'655'786 bytes
SHA256 hash: 0e029c316b6bc7931064a1b5dd2f18213a0581bf447fffbbf687e6cca573aa21
MD5 hash: d6e54e53978b3d55671595687d974681
MIME type:application/zip
File name:2
File size:1'499 bytes
SHA256 hash: a6bfbf8d5bca6033c9eac8aa511bf4d7d6655f6c9a6046e63c3dc57b10ff3902
MD5 hash: cc5f24bf41b0c2cb7d441d0f07cd74e7
MIME type:text/xml
File name:chrome_100_percent.pak
File size:366'009 bytes
SHA256 hash: 15a7b39481995b42e22456bdd8fbca01f4cce57859129cbc1e4631a3afbaa46a
MD5 hash: 655d52b15f7098968d650b0de8a6eaae
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5471a3c6-f1f5-4b73-9351-9c30528d46c3/
Detection(s):
SecuriteInfo.com.Other.Malware-gen.62777533.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Other.Malware-gen.43192518.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69356472920336450abc1241
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
zip
Link:
https://opentip.kaspersky.com/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9/results?tab=lookup
Score:
86%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SVG Zip Archive
Link:
https://app.malva.re/file/b300ced4550e23bf3712d825095ac4f5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-07 14:27:22 UTC
File Type:
Binary (Archive)
Extracted files:
709
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5jd45prpxpygyivzxwnz24w5j7tev3konbtvvjpgsmysu5z6bhuq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260307-vcz9pshv6s/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

PowerShell (PS) ps1 72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d

zip ea47cebe2fbbf06c22b9bd9b9d72dd4fe64aed4e68675aa5e693312a773e09e9

(this sample)

  
Link
https://tria.ge/260307-rm44vscv6r/behavioral2
  
Dropped by
SHA256 72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d
  
Delivery method
Distributed via web download
  
Dropped by
MD5 3a40b9e3347637b831a03c63ae21254e
  
URLhaus
https://urlhaus.abuse.ch/url/3791556/

Comments