🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a
SHA3-384 hash: fde22be35387cf291bfbcf35f5a280730821672ee6953cc7ab5e4e2bcde512fc8fddb2b3a40d732f4580c9e3da405aa9
SHA1 hash: 996b96443fe8d3c95fd91ca677ffed7527b77374
MD5 hash: d4ce704b41b0be61f1eb662482da6ac5
humanhash: seven-harry-georgia-east
File name:SETUP.zip
Download: download sample
Signature ACRStealer
Create hunting rule
File size:21'927'994 bytes
First seen:2026-11-05 02:38:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:flw0higpRSzYnrms2X5P3UEBFtViEfnLiKOLr1j/F0frms2X5P3o8dQFGs9AAWB0:WRgpRSz/s4v36aBO/1j/Fds4v9dQFGkf
TLSH T1BD273324F8663651EC0DDAB400F01DA803E6AD7612BB9BC42379750F8963E6E9F74D39
Magika zip
Reporter aachum
Tags:ACRStealer ipv4-larkfen-cc zip


Avatar
iamaachum
https://usbcej.it.com/ => https://www.mediafire.com/file/jlfetabuuljgzoh/SETUP_lNSTALLER_(KEY.3445).zip/file

ACRStealer C2: ipv4.larkfen.cc

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
PT PT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1fd4165c-9d6f-4a1f-95e7-6b64bdf2c1e9/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac8796014cbaa3940950b70
Tags:
injection obfusc crypt
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a
Verdict:
Malicious
File Type:
zip
Link:
https://opentip.kaspersky.com/2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a/results?tab=lookup
Score:
35%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a
Verdict:
Malware
YARA:
3 match(es)
Tags:
.Net CVE-2019-13232 CVE-2019-9674 CVE-2022-29225 CVE-2022-36114 CVE-2023-46104 CVE-2024-0450 Executable Malicious Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 T1059.007 Zip Archive Zip Bomb
Link:
https://app.malva.re/file/d4ce704b41b0be61f1eb662482da6ac5
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-11-05 02:39:19 UTC
File Type:
Binary (Archive)
Extracted files:
1290
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzy7vaztsyeuqvcpxxn37ocnnvbjvjfmzmtqc3ugxhbmc2qa6sna._file
Result
Malware family:
sectoprat
Create hunting rule
Score:
  10/10
Tags:
family:sectoprat defense_evasion discovery execution persistence privilege_escalation rat spyware trojan
Link:
https://tria.ge/reports/261105-gyadhsff89/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Malware Family:
acrstealer
Create hunting rule
Malicious:
True
Tags:
contains-pe long-sleeps zip detect-debug-environment
Link:
https://intel.virussign.com/intelligence/file/2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:PK_PUMP_AND_DUMP
Create hunting rule
Author:Will Metcalf @node5
Description:Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a

(this sample)

  
Link
https://tria.ge/261105-cn3vvsht7r/behavioral3
  
Delivery method
Distributed via web download

Comments