MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Arechclient2

Vendor detections: 2

Intelligence 2 IOCs YARA 1 File information Comments

SHA256 hash:	fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267
SHA3-384 hash:	d7082801147d174764e58841212e2e9439e20501d2f6003b806f377ada256274b997eac2a872d1e9807ebe93b42653d8
SHA1 hash:	052970815f77a6ea9ac835e6f5e37218ff716062
MD5 hash:	5aa1c8bffdd308e5057a4eeb75563040
humanhash:	nevada-equal-mars-johnny
File name:	Fabrics.a3x
Download:	download sample
Signature	Arechclient2 Create hunting rule
File size:	1'164'012 bytes
First seen:	2026-10-07 04:13:11 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	24576:cVEXXs89nIZybiMLUlp5KLe+RzXewodvuNuDHQEvk+0fSJ3VA/i:cVl7KiEUJUe6ewodhDwb+fj6i
TLSH	T18C3533A5F17DFF74843DF8E9E02F4A88448D0886C1662771A5C74E49AFB08C192F63E9
Magika	unknown
Reporter	aachum
Tags:	178-104-144-200 a3x Arechclient2 AsgardProtector dropped-by-ACRStealer SectopRAT

iamaachum

https://upstream.foxtrail.vip/Fabrics.a3x

SectopRAT/Arechclient2 C2: 178.104.144.200

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad026556f551121ba15a22e

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac5d38cd8ce7d0cbb2f7b6e/reports/edc3fe54-c6bc-4e6e-a8db-2fdc47019861/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267

Verdict:

Unknown

File Type:

unknown

First seen:

2026-09-29T23:18:00Z UTC

Last seen:

2026-10-08T16:47:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7322ntxgkubercgtuevrb2olum4q4mstcxxwqqc5vhel6pqtujtq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/fef5a6cee655024888d3a12b10e9cba3390e325315ef68405da9c8bf3e13a267

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.