MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 52 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2
SHA3-384 hash: 0dc9bfc387af7be80d5a4bb905f0df29cbc07c0bb8e946f9648b2ae5cf13716280f7b19e54b9efda36e44e008aa78d8a
SHA1 hash: bcf53b74d853a68708e6b4b679887f3605ed7dd4
MD5 hash: 40b66f1438ea5cfeaa9f9e92e41bdd07
humanhash: earth-arkansas-ceiling-idaho
File name:SETUP.zip
Download: download sample
Signature ACRStealer
Create hunting rule
File size:9'707'501 bytes
First seen:2025-09-30 19:21:16 UTC
Last seen:2025-10-01 15:54:04 UTC
File type: zip
MIME type:application/zip
ssdeep 196608:X3gJAigCBH1jdqAlbEaf5BnCOzMDJPD9a+H9iQ9/cHG8Ua1f8gS8oBMOpc:X3g3tx5BXQlpzdv9kmY1S8ylpc
Threatray 79 similar samples on MalwareBazaar
TLSH T110A6330DF81F9018F96767B4E6BC2878EA63D9BF94B998933C2090D6281F47452C6CD3
Magika zip
Reporter aachum
Tags:5-161-88-205 ACRStealer HIjackLoader IDATLoader zip


Avatar
iamaachum
https://filesclosedset.icu/ => https://mega.nz/file/DR1URaIB#HVKeYEGCDQexhE5uXWFlJvTH3OsoDxvjTbl30F3rAu0

ACRStealer C2: 5.161.88.205

Intelligence

File Origin
# of uploads :
2
# of downloads :
43
Origin country :
ES ES
File Archive Information

This file archive contains 29 file(s), sorted by their relevance:

File name:Setup.exe
File size:3'722'288 bytes
SHA256 hash: d2d3b25124c846d995bae55da37e7ea4b112da5f7ac4e0e11b79507f67f59053
MD5 hash: 123c894c8cb61f909ee421410071818e
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-synch-l1-2-0.dll
File size:18'384 bytes
SHA256 hash: 9ac63682e03d55a5d18405d336634af080dd0003b565d12a39d6d71aaa989f48
MD5 hash: 659e4febc208545a2e23c0c8b881a30d
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-timezone-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: a108a8f20ded00e742a1f818ef00eb425990b6b24a2bcd060dea4d7f06d3f165
MD5 hash: 69df2cce4528c9e38d04a461ba1f992b
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-profile-l1-1-0.dll
File size:17'360 bytes
SHA256 hash: d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a
MD5 hash: 6ee66dca31c5cce57740d677c85b4ce7
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-process-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 542a22540cdb7df46d957a0208d50507916f7c737bea833931239d56ebe8d68c
MD5 hash: 66f4e530a19ed2f6862b5ce946437875
MIME type:application/x-dosexec
Signature ACRStealer
File name:NvStWiz.prx
File size:442'680 bytes
SHA256 hash: c2ad5bd189df04b39be18dec5cd251cf79b066010706ad26d99df7e49fd07762
MD5 hash: 9e82e3b658393bed3f7e4f090df1fbe7
MIME type:application/x-dosexec
Signature ACRStealer
File name:tradingnetworkingsockets.dll
File size:4'249'928 bytes
SHA256 hash: fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
MD5 hash: 3cf26ce759c5e261fe3ecc6451b8b08e
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-private-l1-1-0.dll
File size:70'608 bytes
SHA256 hash: 696c10112d8b86a46e5057cbd0bf40728e79c6bb49cda1f2c67fe45d0fc1258d
MD5 hash: ad8d9a6ea592a6c8a78c67a805cec952
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-heap-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 0166edfb23cfc77519c97862a538a69b5d805d6a17d6e235f46927af5c04b3c9
MD5 hash: 9c373c00ac3138233bdf1655c7be8e86
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-util-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 68bd9c086d210eb14e78f00988ba88ceaf9056c8f10746ab024990f8512a2296
MD5 hash: c6553959aecd5bac01c0673cfdf86b68
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-synch-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc
MD5 hash: 979c67ba244e5328a1a2e588ff748e86
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-math-l1-1-0.dll
File size:27'088 bytes
SHA256 hash: c7115159babdaa1f52e478e67b4e612da2332fda4e4036999b29425fe303b6e8
MD5 hash: bc418a3461c5fdfa1a0d75f7e03d08a7
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-rtlsupport-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b
MD5 hash: 0069fd29263c0dd90314c48bbce852ef
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-filesystem-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 85b1b189ce9e3c6f4d2efdd4cd82b0807f681bea2d28851caaf545990de99000
MD5 hash: 14f407d94c77b1b0039ae2c89b07a2ff
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-conio-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 4aeeae0ac9f6c1b0b8835067ea3b7fc429f353565f18de7858f4ea5d6f72072e
MD5 hash: 7190cbfad2d7773d3b88ccc25533a651
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-processthreads-l1-1-1.dll
File size:18'384 bytes
SHA256 hash: e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36
MD5 hash: 29001f316ccfc800e2246743df9b15b3
MIME type:application/x-dosexec
Signature ACRStealer
File name:Klirfrumstaeg.gjyj
File size:30'913 bytes
SHA256 hash: 71f81ee363af920818bada73b27579539829cf4382b096fc4516e7184454f3d2
MD5 hash: 5d63574bf2b1edbaa0b85afc79128a6e
MIME type:application/octet-stream
Signature ACRStealer
File name:trading_api64.dll
File size:289'568 bytes
SHA256 hash: f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
MD5 hash: 2bca4e2c047ec969cb3cff277e7fc184
MIME type:application/x-dosexec
Signature ACRStealer
File name:Shusgrond.zbrm
File size:819'498 bytes
SHA256 hash: 3d729840293586259fc8b71bd37d1af80482b206a9fcb6a3b0ec5cb8ebb62b8b
MD5 hash: 6fb1bb8ea47cda045ba9aabe3e5d9721
MIME type:application/octet-stream
Signature ACRStealer
File name:api-ms-win-core-sysinfo-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 1fe918979f1653d63bb713d4716910d192cd09f50017a6ecb4ce026ed6285df9
MD5 hash: cef4b9f680faae322170b961a3421c5b
MIME type:application/x-dosexec
Signature ACRStealer
File name:sptdintf.dll
File size:55'840 bytes
SHA256 hash: 7353ea393051b369f92e230459d6904f88938e1ef94562aaa86342b9aaea7762
MD5 hash: 5b91b8ef0dd74486bcaa38004417e565
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-convert-l1-1-0.dll
File size:21'968 bytes
SHA256 hash: 77b69e829bdc26c7b2474be6b8a2382345b2957e23046897e40992a8157a7ba1
MD5 hash: 3e415147ccd7c712618868bdd7a200cd
MIME type:application/x-dosexec
Signature ACRStealer
File name:ks_tyres.ini
File size:10'077 bytes
SHA256 hash: 894d3c57598ecb22c769cc3ea8219859a95e22740e72394a474012ea2119b3d9
MD5 hash: 47f6571c7884da6c743551ac724186d4
MIME type:text/plain
Signature ACRStealer
File name:api-ms-win-crt-locale-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: f16447b5fc7fe6fb8a6699a3cef1b2b8ba92d408579bcc272d3dd76acd801e2a
MD5 hash: c5d747f96237b6e9aa85c58745d30c80
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-environment-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: 6c9c0dc7b36afe07dfb07dd373fc757ff25df4793e6384d7a6021471a474f0b9
MD5 hash: ad0cbb9978fcf60d9e9ca45de6a28d30
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-string-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 3807db7acf1b40c797e4d4c14a12c3806346ae56b25e205e600be3e635c18d4f
MD5 hash: 2e5c29fc652f432b89a1afe187736c4d
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-multibyte-l1-1-0.dll
File size:26'064 bytes
SHA256 hash: c6b4e1d903b3cc83bfaffbe4e82eee634cff8f97f12217caa45b464ddc4e1455
MD5 hash: 9e9c6f83a015029808f5257f7b7e39c6
MIME type:application/x-dosexec
Signature ACRStealer
File name:Engine.dll
File size:5'486'128 bytes
SHA256 hash: 4859f2c31e07b67cdab2fd06d5dc082728e7498426f3b05dfc09cb31855470c4
MD5 hash: b97ed277b606e52449fe5542a980af7e
MIME type:application/x-dosexec
Signature ACRStealer
File name:DTCommonRes.dll
File size:4'989'488 bytes
SHA256 hash: d96a93c8df94a432445ee7ded1c4f613cee4184f6cd1cf75a02a80f3aa9fb194
MD5 hash: 611289a2938664f8cb4bcbda1013e3cb
MIME type:application/x-dosexec
Signature ACRStealer
Vendor Threat Intelligence
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dc2dbf40b7da0b4eb8e84b
Tags:
vmprotect shellcode injection dropper
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expired-cert microsoft_visual_cc obfuscated overlay packed packed packed signed vmprotect
Link:
https://www.filescan.io/uploads/68dc2dbb74e5a289899ae656/reports/34509b1e-bf7b-4745-9172-5ac315d4df45/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2/results?tab=lookup
Score:
10%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-09-30 19:22:32 UTC
File Type:
Binary (Archive)
Extracted files:
283
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi5qkarodqxb3sq3aaweuekh5axojme6emkoie3tzibokcpmbdja._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
amaterastealer
Create hunting rule
Similar samples:
2d5488f00bdb69c507c308d486032450bb92691800966773acc1928f4077ec1f
ACRStealer
3306b32868590d80dfbcafaba3c6cbbf3514b7b6b4297c41561cec7d769d7b0f
ACRStealer
6c0d55be0a3d4ebb1cf17f7a7ab169474e295d8bb59171c1d4e7eea568cd2a8e
ACRStealer
911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9
ACRStealer
9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba
ACRStealer
aab194f10b0bf13879177d42e353d4f6e82dd61e530a26dd9b3727d31c0263af
ACRStealer
ad81b2f47eefcdce16dfa85d8d04f5f8b3b619ca31a14273da6773847347bec8
ACRStealer
bcc062030c3615d3f8e42e3a2a0b4410e07cf5c845c72c95b56d41d81bac5f46
ACRStealer
c8251d1aba99075ce6f8f735b72015c2589e936bcdf544f87c5947324ec8b056
ACRStealer
error
ACRStealer
f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba
ACRStealer
+ 69 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang
Create hunting rule
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:INDICATOR_KB_CERT_62e745e92165213c971f5c490aea12a5
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Signed_x64_DLL_With_RWX_Section
Create hunting rule
Author:lmxx
Description:Detects signed x64 DLLs with RWX sections (likely packed/protected)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 0a3b05022e1c2e1dca1b002c4a1147e82ee4b09e2314e41373ca02e509ec08d2

(this sample)

ACRStealer

Executable exe d96a93c8df94a432445ee7ded1c4f613cee4184f6cd1cf75a02a80f3aa9fb194

  
Link
https://tria.ge/250930-xwgmtawrt6/behavioral2
  
Delivery method
Distributed via web download
  
Dropping
SHA256 d96a93c8df94a432445ee7ded1c4f613cee4184f6cd1cf75a02a80f3aa9fb194
  
Dropping
MD5 611289a2938664f8cb4bcbda1013e3cb
  
Dropping
SHA256 4859f2c31e07b67cdab2fd06d5dc082728e7498426f3b05dfc09cb31855470c4
  
Dropping
MD5 b97ed277b606e52449fe5542a980af7e

Comments