MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7
SHA3-384 hash:	7e5a28d0621d7406af80f80697b5b51311f1f1e23efc69a8b731a1f6d43611348ef4a7a4737d08789c5ff784db6dfcea
SHA1 hash:	638e54611cbcf047dc179d3d7a02cd9c6966f5ea
MD5 hash:	6d16a649093ee7eb33dc5850ef15be24
humanhash:	twelve-west-echo-snake
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Alert Create hunting rule
File size:	24'307'789 bytes
First seen:	2025-11-04 14:56:53 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:4w5lDyqIpQpQK7Wne0VqDYv48X4KIMAwOYX8VXVJC2LejoJbnBu9UxbqdKvYYpXo:4w5lDFIaQKrYAKgwOYMVFJGa7PYKbF+
TLSH	T1773733C6C6B20FC9D988153881EB5B5B725947560821C32B4B75E20F7FF3BE4CA76A06
TrID	37.5% (.KMZ) Google Earth saved working session (6000/1/1) 37.5% (.WMZ) Windows Media Player skin (6000/1/1) 25.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	138-199-199-150 2265ca ACRStealer Amadey file-pumped zip

iamaachum

https://fighthem.space/ => https://mega.nz/file/VBsGVaQJ#hZwJOvwBWKW13SAhDHGi0Oe2M88zg-Uu14fE9HXnPj0

ACRStealer C2: 138.199.199.150
Amadey Botnet: 2265ca
Amadey C2: http://mi.huffproofs.com/kaWt2QXfpPueNM/index.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

ES

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	707'208'268 bytes
SHA256 hash:	9e0422e247be6703c59014b64281f01a04ddb3e7e771b71f6b0cc8d14d74b923
MD5 hash:	93a00ab2324553e79d62b8c4d882e37a
De-pumped file size:	535'801'856 bytes (Vs. original size of 707'208'268 bytes)
De-pumped SHA256 hash:	54461b2069e222893c1133976073941a132290387fb5b02d40435e072d97bd51
De-pumped MD5 hash:	786fd88c76f2257e4012bcf6c278d177
MIME type:	application/x-dosexec
Signature	ACRStealer

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690a14629942f1282ecbf78d

Tags:

spawn hype sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm anti-vm base64 bloated crypto crypto dllhost evasive expand expired-cert explorer explorer finger fingerprint fingerprint fingerprint hacktool installer-heuristic invalid-signature keylogger large-file lolbin lolbin microsoft_visual_cc overlay packed regedit regedit rundll32 signed tracker wmic wsl

Link:

https://www.filescan.io/uploads/690a146c85b61a93a7345d9c/reports/b21476d6-4b1c-4680-8715-fcd0fa487ec1/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

First seen:

2025-11-04T12:31:00Z UTC

Last seen:

2025-11-04T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7fu56dhhivuwvpxrmfdifq5ep6qednspbsdgntn4lvagqdp2kktq._file

Hatching Triage acrstealer

Result

Malware family:

acrstealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:acrstealer discovery execution spyware stealer

Link:

https://tria.ge/reports/251104-taj92avmdq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Command and Scripting Interpreter: PowerShell

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Badlisted process makes network request

ACR stealer,GrMsk

Acrstealer family

Detects unpacked ACRstealer payload

Malware Config

Dropper Extraction:

http://87.120.219.26/CCZT7wMNnD29ie

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7