MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778
SHA3-384 hash:	32a3d3cdd6f830c7ed52d48177b4b3a2668c0132ec6876f152f4a7370429fc7a88dae67270de4f68577f0a4fe8121688
SHA1 hash:	27f715b6f45513cc04adf76e084bd1bdee4555d3
MD5 hash:	fbba585bde3395f2348b94291333a1e6
humanhash:	johnny-jersey-india-diet
File name:	Main Setup.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	27'539'786 bytes
First seen:	2026-03-18 21:45:45 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:RKK/8/2vD/QMsz3wUHQNWCd4JEr6Htt2GgGQ:RKFeL/Qzz3w0QOZNzHQ
TLSH	T1EF57337CCC0FB564E165BE3EE043971AD9E0AA0352642E4EA6B424A85DEF7C9C781317
Magika	zip
Reporter	aachum
Tags:	46-29-235-240 85-137-252-164 ACRStealer dllHijack zip

iamaachum

https://iergfyelw.it.com/ => https://1drv.ms/u/c/f2a2291715e1506b/IQCcbD-JL7iERZ2sox9uRMBoAUPUJyCZzk9lry1d59o7108?e=1hIxYA

ACRStealer C2 and Dead Drop Resolver:
85.137.252.164
https://telegra.ph/Atkins-03-12
46.29.235.240

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

44

Origin country :

ES

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9e9be57a-3bef-4b6e-9b7e-c2d6c6e71691/

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b9b1ce88c80c01586b5fe4

Tags:

infosteal

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6if6r5trx6mnu4ypznmg3wgb6iyrr2tshuujoubpvyzstke7454a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778