MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa
SHA3-384 hash: 186102a42f3b62eda5efb63b807aff0c57e8b509490585d633a00e16a4fba1aa15c47dd030c43f3f49b086359890c329
SHA1 hash: aa70e46fe7ab46bb108e0e0c402ef9bf787de01b
MD5 hash: d28a9bf89c08bfef7b48932d777b2421
humanhash: magnesium-may-twenty-paris
File name:ap.dll
Download: download sample
Signature ACRStealer
Create hunting rule
File size:7'234'024 bytes
First seen:2026-07-24 12:30:48 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a296cbaca5eedb10423928b73efd01c2 (1 x ACRStealer)
ssdeep 98304:SJYWmkeHsQpjpAx4wcvEajnsMxiem3+/6NuVxujOe/HZS9in8:S/oNpAx4ncazA+jxuj2/
TLSH T1F576B21237C85126EC6D3A3E067A6340B96E69BD1814473A2E54C4EB7B279D378FC70B
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Anonymous
Tags:ACRStealer dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75945/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Malicious
Labled as:
Capa_get_geographical_location
Link:
https://www.hybrid-analysis.com/sample/3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa
Verdict:
Unknown
File Type:
dll x32
First seen:
2026-07-23T17:08:00Z UTC
Last seen:
2026-07-23T17:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa/results?tab=lookup
Malware family:
AresLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4e9a590-6ac1-4cfb-ba00-6bf3ae05948b
Score:
45%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/d28a9bf89c08bfef7b48932d777b2421
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-23 21:20:12 UTC
File Type:
PE (Dll)
AV detection:
10 of 36 (27.78%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hmuydy2eo3vcrvkvxduoddtclllonk25mcx7qexvz4vldsuowp5a._file
Verdict:
malicious
Label(s):
AnimateClipper
Create hunting rule
Link:
https://reports.threatray.com/8800aab5-b86d-4f67-b53b-e9ded30ccfd9
Similar samples:
051661deb65c018c8c127fe12a6de824e6a72812db0091d505de1751e740b451
ACRStealer
3f78e34867be90fecdd3ec820f93a0befb9f786eb9479676f4c7bbc878ca1343
ACRStealer
6546d4bcaf4bd2848d6f5d86def14961a312b482302a12c7850f5dd1d58601cf
ACRStealer
86471a7fea86de0cd8301ab2e5220170e154f71a14ce04b15ba67d1ab62a0b7c
ACRStealer
d0e33939f7f9336dc6c2108d187a71e26c8449d289dcb8f8d9fe7b9777bc373a
ACRStealer
fc4620979693731666485dd051ae435d4a0fedd65a048f7b49a397ff7b379365
ACRStealer
Result
Malware family:
animateclipper
Create hunting rule
Score:
  10/10
Tags:
family:animateclipper clipper discovery persistence spyware stealer
Link:
https://tria.ge/reports/260724-pp14wazfra/
Behaviour
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Badlisted process makes network request
Detects AnimateClipper
Family: AnimateClipper
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa
MD5 hash:
d28a9bf89c08bfef7b48932d777b2421
SHA1 hash:
aa70e46fe7ab46bb108e0e0c402ef9bf787de01b
Link:
https://www.unpac.me/results/f9f88c78-a7a2-439d-8e28-740246226e97/
Malware family:
ACRStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3b2981e34476/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3b2981e34476ea28d555b8e8e18e625ad6e6ab5d60aff812f5cf2ab1ca8eb3fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_DustSquad_PE_Nov19_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detection Rule for APT DustSquad campaign Nov19
Reference:https://twitter.com/Rmy_Reserve/status/1197448735422238721
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SR_APT_DustSquad_PE_Nov19
Create hunting rule
Author:Arkbird_SOLG
Description:Super Rule for APT DustSquad campaign Nov19
Reference:https://twitter.com/Rmy_Reserve/status/1197448735422238721
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75945/

Comments