🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
SHA3-384 hash: 36d79e02385a98506ba1283263b48c9bee02b4a95735bd36cdbb9c9f672667af53d3478dc30ef4567ce6fa96593805f1
SHA1 hash: c40402c67627a0ae2d1d2540e487a3e39d62ec45
MD5 hash: ca52212011191040d4ad8fbc9b8a9568
humanhash: ohio-lemon-muppet-michigan
File name:mozglue.dll
Download: download sample
Signature ACRStealer
Create hunting rule
File size:167'912 bytes
First seen:2025-10-04 00:26:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9fcd8f5d38eb61c629c9bd3bd71964da (2 x ACRStealer)
ssdeep 3072:N/YMAHtU/BbeXJy9x4N48TuxpXvV2w3vk9EAXJd7ZU9pk6u1pPr0ay0KdFi9jCp7:NCi/BbeA9C4yQvsHEnTEp4L0qFi9jCp7
TLSH T1B4F38C0BB36810A9E963C138CA96A356F7B3B82147155BDF12D457B90F33BE43A3A741
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter aachum
Tags:5-161-95-160 a9321e ACRStealer Amadey dll HIjackLoader IDATLoader


Avatar
iamaachum
https://earshows.xyz/?ejCqvXS-utm=1KsroC => https://mega.nz/file/7wRTADpL#KHyTbQ1Jk0CESUqmvur35-e7F6jL6uae9VxZy3HQWpM

ACRStealer C2: 5.161.95.160
Amadey Botnet: a9321e
Amadey C2: http://mi.barbertingling.com/kaWt2QXfpPueNM/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
mozglue.dll
Verdict:
No threats detected
Analysis date:
2025-10-04 00:29:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9ba4255e-9d60-45f7-aa39-f1cb6ee4a036

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/30090/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e069b7482d8e84a7ec0c20
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm expired-cert hijackloader invalid-signature masquerade microsoft_visual_cc signed
Link:
https://www.filescan.io/uploads/68e069b7d4a0085473bfe585/reports/c7b3bd3e-e26d-48b9-b189-11012f814907/overview
Verdict:
Malicious
Labled as:
Win64/TrojanDownloader.Rugmi
Link:
https://www.hybrid-analysis.com/sample/048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
Verdict:
Unknown
File Type:
dll x64
First seen:
2025-10-03T22:49:00Z UTC
Last seen:
2025-10-04T09:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/bd55a7fd-bca9-4743-a726-0e0d73df48d7
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
7 / 100
Link:
https://www.joesandbox.com/analysis/1789073
Behaviour
Behavior Graph:
n/a
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ca52212011191040d4ad8fbc9b8a9568
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-03 01:19:39 UTC
File Type:
PE+ (Dll)
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=asgyhxzy5nf67nasoqdiohqehznwhkrwvnrngk4enoyqa4f5ifnq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/251004-ar2qvsgl4s/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8af20313-e80f-4745-b7be-062d9b086650
Unpacked files
SH256 hash:
048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
MD5 hash:
ca52212011191040d4ad8fbc9b8a9568
SHA1 hash:
c40402c67627a0ae2d1d2540e487a3e39d62ec45
Link:
https://www.unpac.me/results/2b5a484f-f908-4a41-a612-ffc7d732424b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 598ea16c40646305a18227410a473eede57009cdc00e793b157239b200964977

ACRStealer

Executable exe 048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b

(this sample)

  
Dropped by
SHA256 598ea16c40646305a18227410a473eede57009cdc00e793b157239b200964977
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/30090/
  
Dropped by
MD5 01ea227967d19c05ce5e67e369a89128

Comments