🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3
SHA3-384 hash: 855e8e5bb22f461fa1b96e33c54a018018a751db2c579412b46281e4626a28b0884b9c2a65e188a4de1eabbe1430bd0c
SHA1 hash: bac188b67b416e4f3e3901d0ffa40cb2e8ae94ff
MD5 hash: 00f5435a9d60a41386fcf4b4f5c405af
humanhash: georgia-five-ohio-carbon
File name:00f5435a9d60a41386fcf4b4f5c405af.exe
Download: download sample
Signature ACRStealer
Create hunting rule
File size:808'960 bytes
First seen:2026-09-25 07:57:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fa48bde0d88f8952c0eb49ac6798fb45 (2 x ACRStealer)
ssdeep 12288:mZGFqEI19Py6KJcISAZjNudyMIiEfKqr0/:mLE89Py6KJNS8jQdyMOx0/
TLSH T1B9059F67E5E392F1DDA32476721BB33B6FB1DC01C279DBC6DBD52852CA23620812B815
TrID 21.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:ACRStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-25 08:08:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e75ec417-40fc-442b-9f59-09d74bf6d593

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/88934/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.66553252.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ace099b853d431abd4df8e3
Tags:
malware
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context base64 evasive fingerprint
Link:
https://www.filescan.io/uploads/6ab62997befc01ce94e65b7c/reports/840ee658-6f30-4936-9537-4ab7ec0c1e0e/overview
Verdict:
Malicious
Labled as:
Capa_get_geographical_location
Link:
https://www.hybrid-analysis.com/sample/0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3
Verdict:
Unknown
File Type:
exe x32
First seen:
2026-09-26T22:07:00Z UTC
Last seen:
2026-09-26T22:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1f3d6130-1a8c-44b1-a945-f66755317cd8
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1978070
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/00f5435a9d60a41386fcf4b4f5c405af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3/
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-09-13 00:11:44 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
26 of 38 (68.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=btudcts7bozc4tyokvcjkwcyqjzbpingtuylbxltp5cseqwbatzq._file
Verdict:
malicious
Label(s):
Amatera
Create hunting rule
Link:
https://reports.threatray.com/12aa28b8-de45-4e8c-add5-d8257129a1dc
Result
Malware family:
acrstealer
Create hunting rule
Score:
  10/10
Tags:
family:acrstealer discovery stealer
Link:
https://tria.ge/reports/260925-jtgyxawtez/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Malware Config
C2 Extraction:
sso.activeloop.cc
Unpacked files
SH256 hash:
0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3
MD5 hash:
00f5435a9d60a41386fcf4b4f5c405af
SHA1 hash:
bac188b67b416e4f3e3901d0ffa40cb2e8ae94ff
Link:
https://www.unpac.me/results/7cabef3d-fd10-46b9-88f5-faeadd522955/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/0ce8314e5f0bb22e4f0e5544955858827217a1a69d30b0dd737f452242c104f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/88934/

Comments