MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f
SHA3-384 hash:	03c93ef1181e7663498a3938954c18f616a8bd727432b78b5d42a537aa75ddc6463b81e5d81fb8edb50cfc7345f749c8
SHA1 hash:	6fbdd3cc92ce6c82234235db6bb2d8336bbbc899
MD5 hash:	fcf05997f62ff7af03575abd10378c1f
humanhash:	fifteen-red-river-potato
File name:	SETUP.zip
Download:	download sample
Signature	CoinMiner.XMRig Alert Create hunting rule
File size:	19'094'991 bytes
First seen:	2026-07-15 09:55:38 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:fvoJYBm4PaJBjPvwL4835pf/9vV0wveZBYUnM8IFbUMM4WHLLT:fvoJm5EtgL445ptvV0wwznL+hMT
TLSH	T1541723BCB4B5B96AF5D4433BC7852CB6DB2CA500D7993D9F8E2041927DC320E5F6A821
TrID	50.0% (.BIN/ZIP) 1C:Enterprise bundled add-in (12000/1/2) 33.3% (.XPI) Mozilla Firefox browser extension (8000/1/1) 16.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	ACRStealer CoinMiner.XMRig logs-workflowengine-cc zip

iamaachum

https://wdnvffur.it.com/ => https://www.mediafire.com/file/m38tdrgxaa1uuzk/SETUP_FILE_(PASS_KEY=2113)+.zip/file

ACRStealer C2: logs.workflowengine.cc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

ES

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a1e31980-cf91-4d0e-8339-a676e903f700/

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0788d746d6967b3d909643

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-07-15T07:03:00Z UTC

Last seen:

2026-07-16T19:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f/results?tab=lookup

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f

Malva.RE Malware

Verdict:

Malware

YARA:

3 match(es)

Tags:

.Net CVE-2019-13232 CVE-2019-9674 CVE-2022-29225 CVE-2022-36114 CVE-2023-46104 CVE-2024-0450 Executable Malicious Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.46 SOS: 0.51 SVG T1059.001 Zip Archive Zip Bomb

Link:

https://app.malva.re/file/fcf05997f62ff7af03575abd10378c1f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-15 09:05:36 UTC

File Type:

Binary (Archive)

Extracted files:

850

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=753ai5qdr76mqlbl6lftvxozxbvt6ld2qsvtxl73pxjxar3lgshq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution spyware stealer

Link:

https://tria.ge/reports/260715-q3yfksdx8m/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

System Location Discovery: System Language Discovery

System Time Discovery

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Reads user/profile data of local email clients

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f