MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdfc291fddac774f565429233fa57848d6bd4ae21a3531c2283b174be47e56ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fdfc291fddac774f565429233fa57848d6bd4ae21a3531c2283b174be47e56ba
SHA3-384 hash:	691b5210c4d6dc4aab87e17b029fdbbc93cc03da5b3ac2875d71c931ed93ed0d9e731dd06744875455a7ca0971de11dc
SHA1 hash:	cf3412fc83b2f7a7c9225d49fb40a1151c0f0235
MD5 hash:	766969a7e8b586c845c3f3ec1695ef9f
humanhash:	low-ohio-carbon-echo
File name:	𝐅𝐔𝐋𝐋_Sᴇᴛᴜᴘ ✦ 𝐋𝐀𝐓𝐄𝐒𝐓_2026.7z
Download:	download sample
File size:	41'710'909 bytes
First seen:	2026-06-28 16:15:52 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 2026
ssdeep	786432:hwHOGcmWqO4qILl/rBv7eMzhW99EvVHsZoPu+mTrVNddhgCWa1Aze3ct:iHOGcmHO4rl/dvqoheIO+PKTrVLdhgwo
TLSH	T1BF973386FE4F7EA93DD3FB9B902C71824ACC7828360BAD9B39910E457867D165074E0D
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z ACRStealer file-pumped proxy-fluxautomation-cc pw-2026

iamaachum

https://pcsofthub.cfd/rapid-99/ => https://www.mediafire.com/file/93asyl7aew64u7i

ACRStealer C2: proxy.fluxautomation.cc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

58

Origin country :

ES

File Archive Information

This file is a password protected archive. The password is: 2026

This file archive contains 10 file(s), sorted by their relevance:

Relevant files 2

File name:	Setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	104'920'872 bytes
SHA256 hash:	b28d4eabe7c00aabd769d468ecb6ab7c686f3d17ce3153b3ebf9b2525db9d8eb
MD5 hash:	79e2651417854733d99906e56fab8319
De-pumped file size:	104'913'408 bytes (Vs. original size of 104'920'872 bytes)
De-pumped SHA256 hash:	178eaa3985c2f57a1480a05390bc171368095b04c0954dccc9afed68cd36a14d
De-pumped MD5 hash:	48078a426b231434dc9b16c5f97436a3
MIME type:	application/x-dosexec

File name:	𝙎𝙀𝙏𝙐𝙋.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	103'939'904 bytes
SHA256 hash:	c6e980076d2a4655d2ec49157b08c2b63debf761cd3053e5e11a4544d6349c96
MD5 hash:	c7e07530187e7c8c26fd8a72429708b1
De-pumped file size:	103'932'416 bytes (Vs. original size of 103'939'904 bytes)
De-pumped SHA256 hash:	17c9fc1236578ac6416430ebc6fe4a62a0ce18e36f46ff23452bfa2afdd7f469
De-pumped MD5 hash:	67836ad45f6626c63924fba1e26bf986
MIME type:	application/x-dosexec

Potential files of interest 6

File name:	installed.dll
File size:	264'504 bytes
SHA256 hash:	68546336232aa2be277711afa7c1f08ecd5fcc92cc182f90459f0c61fb39507f
MD5 hash:	0ac98a4bfc717523e344010a42c2f4ba
MIME type:	application/x-dosexec

File name:	AppVClientPS.dll
File size:	27'016 bytes
SHA256 hash:	30fe6fe879acb368a0f03fc95717cee9abbb7a5ed9611b3f9ecf12054c1156a8
MD5 hash:	fbd4271b0b048dd23f19e53bd59ef453
MIME type:	application/x-dosexec

File name:	api-ms-win-service-core-l1-1-0.dll
File size:	12'640 bytes
SHA256 hash:	45a560f445fd3cb4db594f51a3d0b3c191a8836b635d601d36361c3089ab010f
MD5 hash:	05afa23d325d7ac649727f757c541a35
MIME type:	application/x-dosexec

File name:	api-ms-win-service-private-l1-1-1.dll
File size:	13'672 bytes
SHA256 hash:	1be31ff67d0a87fb5106f710065fe75bbf9fca5d3c18a9712e9a0d30c0cb2003
MD5 hash:	d454f8b93d64c222fa23920954365ca7
MIME type:	application/x-dosexec

File name:	cflang.dll
File size:	268'600 bytes
SHA256 hash:	b3ad99afdaee3b9365e7a3ffcc44c2761e22a4f92dff5e5efdc52f6b08ea0105
MD5 hash:	41c75e831a5571c3f72287794391a0e6
MIME type:	application/x-dosexec

File name:	logfiles.dll
File size:	57'443 bytes
SHA256 hash:	515c8e0b93f0fef15da3e2573ad92b7e7840374140e65e5d73df63d8e22cb3e8
MD5 hash:	05e61539b8917fca37c03756bbdd043d
MIME type:	application/x-dosexec

Other files 2

File name:	Instructions!.txt
File size:	1'769 bytes
SHA256 hash:	0728664c8aa5805bf9e4ef8fbe84e0833127185a5097bda12b6156a15bcb29ec
MD5 hash:	1392ee9ea02404bb350ae5e982a16bd3
MIME type:	text/plain

File name:	cached
File size:	0 bytes
SHA256 hash:	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash:	d41d8cd98f00b204e9800998ecf8427e
MIME type:	inode/x-empty

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

70.0%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4148fb86bc95245bfa49ce

Tags:

injection obfusc madi

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fdfc291fddac774f565429233fa57848d6bd4ae21a3531c2283b174be47e56ba

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7x6csh65vr3u6vsufert7jlyjdll2sxcdi2tdqrihmluxzd6k25a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.