MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b
SHA3-384 hash: aa31b31333beccb8a4cc9c7d04d7e0225c2f2ae35d867e71b12f010d38224c4f672431cc73ec8bec190134d3b225b000
SHA1 hash: 76cbe7c3eacb10d397fc9f483a89032c8ad0d3f4
MD5 hash: 00c70fe113fbba486e9b539bfdae3d33
humanhash: hydrogen-xray-eighteen-iowa
File name:Setup_1764755978508.zip
Download: download sample
Signature ACRStealer
Create hunting rule
File size:13'271'393 bytes
First seen:2025-12-03 18:52:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:V2A2i7WWFRxd9j663XtBjskpXKuT55T5ROA53/j12o2:VvzHx6IVswnbOo527
TLSH T154D633AC2D769894F63544B4809B7F37E85B0821DB83819873C5E281C5F7F6E9BB8C58
Magika zip
Reporter aachum
Tags:87-120-219-23 ACRStealer AutoIT CypherIT file-pumped zip


Avatar
iamaachum
https://disk.yandex.ru/d/sQYWFlxboO7WcA

Intelligence

File Origin
# of uploads :
1
# of downloads :
40
Origin country :
ES ES
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:My Files.txt
File size:0 bytes
SHA256 hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash: d41d8cd98f00b204e9800998ecf8427e
MIME type:inode/x-empty
Signature ACRStealer
File name:10MB.bin
File size:10'485'760 bytes
SHA256 hash: b4a5f0fcc07479a67dc73a4d169af5ca172204828367551f0890c9c54041a1f6
MD5 hash: 393cf9fb9eb9711c3e15c61e3f161fd7
MIME type:application/octet-stream
Signature ACRStealer
File name:Read me.txt
File size:1'769 bytes
SHA256 hash: 0728664c8aa5805bf9e4ef8fbe84e0833127185a5097bda12b6156a15bcb29ec
MD5 hash: 1392ee9ea02404bb350ae5e982a16bd3
MIME type:text/plain
Signature ACRStealer
File name:Setup.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:125'849'992 bytes
SHA256 hash: 11567ccf96e4bab9504cf92155775a1be6472d8981b1d59e8232418763114989
MD5 hash: d83eb262ed4dc900fc2f62c53a381dc9
De-pumped file size:1'304'064 bytes (Vs. original size of 125'849'992 bytes)
De-pumped SHA256 hash: fe251bb1c14b74a0832b049be399bf72f9a3a638846d9e89c614942440e221e7
De-pumped MD5 hash: 960ad9da0c6d048617b1a610ff382adf
MIME type:application/x-dosexec
Signature ACRStealer
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f2f252c7-2660-4f6d-ab82-d9ab07909862/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69015979706befaf4ec9d567
Tags:
infosteal emotet
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b
Verdict:
Malicious
File Type:
zip
First seen:
2025-12-04T00:14:00Z UTC
Last seen:
2025-12-04T00:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b/results?tab=lookup
Score:
30%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b
Verdict:
Malware
YARA:
3 match(es)
Tags:
AutoIt CVE-2019-13232 CVE-2019-9674 CVE-2022-29225 CVE-2022-36114 CVE-2023-46104 CVE-2024-0450 Executable Malicious PDB Path PE (Portable Executable) PE File Layout Zip Archive Zip Bomb
Link:
https://app.malva.re/file/00c70fe113fbba486e9b539bfdae3d33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=db4uvg45aqugcrhfzki737wdygg2dbqpc4th5vup4xsm4o57te5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/251203-xp3lpsvkcl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Script
Create hunting rule
Author:@bartblaze
Description:Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b

(this sample)

ACRStealer

Executable exe 70428c1fd7f8879239050155e0a37ed65c6997855e8a8420e2d2f09598ba5cd6

  
Link
https://tria.ge/251203-xbggbaspes/behavioral2
  
Delivery method
Distributed via web download
  
Dropping
SHA256 70428c1fd7f8879239050155e0a37ed65c6997855e8a8420e2d2f09598ba5cd6
  
Dropping
MD5 949ce8d74fb987d0d11827a510cc730d
  
Dropping
SHA256 fe251bb1c14b74a0832b049be399bf72f9a3a638846d9e89c614942440e221e7
  
Dropping
MD5 960ad9da0c6d048617b1a610ff382adf

Comments