MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c
SHA3-384 hash:	71f6a84431043894a9bdd4d1797e9167661607ea973eafbbcd921bd393d4797c39f9e99abb5146bf1ccde943f6fa7b19
SHA1 hash:	6488c8f4b40ff3567ddbc90a4d6e66e04e9d6f59
MD5 hash:	62a4a7115995b52d9d2f04773676adc9
humanhash:	robin-arkansas-wolfram-vegan
File name:	«𝚈𝚞𝚛𝚜𝙵𝚒𝚕𝚎𝚁𝚎𝚊𝚍𝚢𝙳0𝚆𝙽𝚕Ö𝚊𝚍««4405»»_».7z
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	9'101'597 bytes
First seen:	2025-11-08 12:59:13 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 4405
ssdeep	196608:QHUewirlVxtBD1N/nSFfoWyRgdAw6tBCEvYk7BIE4yIh0h:kwirlVPbU5ZdeXrwY/cm
TLSH	T1F0963393439C53AA5CCE26DB07A5013738BC1B9053A5078E04EFBDD435DFB6224ADBA9
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	2265ca 7z ACRStealer Amadey HIjackLoader IDATLoader pw-4405

iamaachum

https://cludchpfile.click/ => https://mega.nz/file/TQlDlDDb#nV7UIK0nQSU-xVYhM1DwpwvGYagi0YuPmQ5kgRc7mZg

Amadey Botnet: 2265ca
Amadey C2: http://mi.huffproofs.com/kaWt2QXfpPueNM/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

178

Origin country :

File Archive Information

This file is a password protected archive. The password is: 4405

This file archive contains 108 file(s), sorted by their relevance:

File name:	Setup.exe
File size:	1'806'608 bytes
SHA256 hash:	9155314a52c72e0b5c43e6eb061b212b5c2f827ce61130e1675f02c6aa0bef3a
MD5 hash:	74ac74e35ac92b4c333e9e109175f200
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	MSHY7EN.DLL
File size:	223'624 bytes
SHA256 hash:	ed4e8eca8f346e3d5e0fcef61dff7aec8007e23279e63389b544303eefccc780
MD5 hash:	e46498f30744a11f7f75bc582b43ef7a
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.AspNetCore.SignalR.Core.dll
File size:	461'080 bytes
SHA256 hash:	ffb9cc74a2009a32283a4565fa211303e6d7ba53e76154ebd6347e471d9d5f5a
MD5 hash:	220d5d6acb9f993ddfde8c0a5c6d00e0
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	rename_variation7-win32.phpt
File size:	983 bytes
SHA256 hash:	5d3f4f0bd77918f745c9f0b2428f16b4450e41eae787277ef8861e259df9b367
MD5 hash:	1dbc1c0dbec842f1623858a7aeb354d9
MIME type:	text/plain
Signature	ACRStealer

File name:	jdtojewish64.phpt
File size:	409 bytes
SHA256 hash:	be36ab7b00383344ea676ee0522bde3877bec4bd1ab342588d88003e003693fa
MD5 hash:	8997534c043fa2dc22ce1d2c1757815d
MIME type:	text/plain
Signature	ACRStealer

File name:	sign.txt
File size:	26'860 bytes
SHA256 hash:	0d9aa3084e3d33259ba779b7371d87a638569b7aea96eff383f0f7b61b507fd4
MD5 hash:	e95d7633f832be27bd898a866a0dfb4a
MIME type:	text/plain
Signature	ACRStealer

File name:	qtiff4.dll
File size:	309'760 bytes
SHA256 hash:	72a580fc4b7351c3da30b9aeb2e9a1c3ad78f7eab5c3aee36f04b73e22e7e1f8
MD5 hash:	881e84c568c8ffed52ab8b1d004b17e8
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	netstandard.dll
File size:	1'319'560 bytes
SHA256 hash:	1799854d01a89d141fecc4c4548b01e51fa57118c9b18eac66a752f3bbe98c02
MD5 hash:	ba3408bebbcd7eb67ec979cee7b60498
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	mit2ms.exe
File size:	18'000 bytes
SHA256 hash:	4e35ad89f6c6b9ae0360ba35b784c545fa6e891ec1ed4154de30fbd27f297c17
MD5 hash:	18fd72301b28863b76951bcafc5d15c3
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	session_set_save_handler_basic.phpt
File size:	3'002 bytes
SHA256 hash:	2f1cc105ba99fed79cda98c96e2f1b73cf1e6980d54fdfde9f9b04542d573f63
MD5 hash:	9310cc2d8d547773484502c8600269a9
MIME type:	text/plain
Signature	ACRStealer

File name:	MSODCW.DLL
File size:	687'968 bytes
SHA256 hash:	053cc3b9007a3e7dc7b045ed0631c30f08e59b19f64f97866d0335dcc1b543c3
MD5 hash:	1889bf2cefc41d836902455e4823d6e9
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	BugSplat64.dll
File size:	558'464 bytes
SHA256 hash:	8fe9be5391cef47155ba98879ec86747b9e5e31c5d1f18079fd389c52901b4b9
MD5 hash:	e41209afb442b87d598f845eb549c387
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll
File size:	279'072 bytes
SHA256 hash:	e5e076e14182227c6d853735b77d1e92cf81bd3b91009b3b788af94fad158456
MD5 hash:	337931d5dd5cdcee396e4880c6256429
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	el.txt
File size:	17'042 bytes
SHA256 hash:	cf90a21c69a13e0d674b6b74e2904f7d9d3bee594d89862155d94105311f47a7
MD5 hash:	812df218dae08f9f883a7455015707b2
MIME type:	text/plain
Signature	ACRStealer

File name:	test_cp874_1.phpt
File size:	757 bytes
SHA256 hash:	fd86671d4810cf6939f3a72e959c5b9ff7f2d17f3fadf11a7f57745816572401
MD5 hash:	a2c5604e9ac398a7fa0d3aeef20e8f99
MIME type:	text/plain
Signature	ACRStealer

File name:	UKRAINE.TXT
File size:	4'634 bytes
SHA256 hash:	274fe9bddd25b28d12f0f054bdd42400ed5e93a1167b09d9f348bc832f10b291
MD5 hash:	bd1e4b7ff531d4a55b6a9b806357c1ff
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.VisualStudio.DesignTools.XamlDesignerHost.dll
File size:	770'096 bytes
SHA256 hash:	f35ea349c8cdbc59fd56c0bc08d31c6fa3668c8bb384cf34103f3ee0f26cb6ea
MD5 hash:	a0a70f7574f429e531b28a43c7fbb544
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	TSLogSDK.dll
File size:	855'816 bytes
SHA256 hash:	ad2933bde1c9fc096cbd7d519e8f2234a3094fa20975de6b2014a5c3a1f72e2f
MD5 hash:	0f61ec1794edafa62a4c737d7995f92a
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	lib_TSMp4FrameScanSDK.dll
File size:	928'016 bytes
SHA256 hash:	7cb0044d729a6c39d230136a26c4f6243eb0bc190aa1c955b02f7753cf498384
MD5 hash:	aa81b50131b8810b5fae7f8a3c116612
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.TeamFoundation.VersionControl.UIFeatures.dll
File size:	503'328 bytes
SHA256 hash:	2420328213fa150b94c782e6bcb2cfc40a38cf3d2cfee50cb9a192793e5d9a9b
MD5 hash:	de14665aa8b40496716e5a25f3a78b0a
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	libmpg123_plugin.dll
File size:	420'992 bytes
SHA256 hash:	1c601974b0c6e14d4dac543f593bff032054d0ca3ce732d7eb580ac4494164fa
MD5 hash:	21066299fd7ecbcd97fe2f510bc4ba1d
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	bug54323.phpt
File size:	537 bytes
SHA256 hash:	42b205cb108f9538d356c345947faf9f2fead69de50c63708e9fc0c2d26eda84
MD5 hash:	23bfa816433d249541057764af91b0ce
MIME type:	text/x-c++
Signature	ACRStealer

File name:	mod_list_command_line_arguments.txt
File size:	626 bytes
SHA256 hash:	7525569fb805af0e0769ecfafcccb8ee6e06663fab88e5e24bdcac9f6599165f
MD5 hash:	4a5497f6d0a445e027c979c6f5bead30
MIME type:	text/x-c
Signature	ACRStealer

File name:	objc.dll
File size:	244'064 bytes
SHA256 hash:	ed49012c1afb709de4775e570e8df4bc2f11017e9f71c2f2fd243ae8a8174eaa
MD5 hash:	a55ec6e25d4f6d954a9fb52688a847e9
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	error_reporting07.phpt
File size:	360 bytes
SHA256 hash:	f5b1d45b94be82bb563f5ea42064a40296c404e57ac70c18d6a44bd5f461c2fd
MD5 hash:	44ec6eda4a8b56bab7a5cc2538830347
MIME type:	text/plain
Signature	ACRStealer

File name:	fpm_systemd.c
File size:	3'146 bytes
SHA256 hash:	1f3cc753d83526ecdb647549cd316ef4914d0a0d8ecf758da56be3fe14728d55
MD5 hash:	4c3753dc4ee39c1352b39cd755820b82
MIME type:	text/x-c
Signature	ACRStealer

File name:	bug47572.phpt
File size:	333 bytes
SHA256 hash:	8e55f5285ad83a6b5b987fc3aadc07cbdf22cb5d1ab5a2c191c2ae29381895f4
MD5 hash:	735b4c505b27e611047cbdf6dd422cfc
MIME type:	text/x-c++
Signature	ACRStealer

File name:	026.phpt
File size:	381 bytes
SHA256 hash:	cdf9e95cb76443b88a81bff42a4d2e32c99aaa2f55de7ac716d0a4fd4e66e049
MD5 hash:	f8da612472863ac33c22b11d6776a65e
MIME type:	text/x-c++
Signature	ACRStealer

File name:	ONBttnWD.dll
File size:	644'472 bytes
SHA256 hash:	0e5123a235eba15530e0028076a159355e80fa3a8591d4924f6abbf5a2366519
MD5 hash:	e356385ee71330e7bbbfe100aadc4e4d
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	ctype_punct_basic.phpt
File size:	405 bytes
SHA256 hash:	083e30bc1fad498c9d6e2f87282b7c1b7c6dc1263180fb7cb00cbd0c77ebf3e4
MD5 hash:	fc2325efef5ded905d27de6b48bbc9ef
MIME type:	text/plain
Signature	ACRStealer

File name:	phar_buildfromiterator9.phpt
File size:	1'109 bytes
SHA256 hash:	dd552a9cc03c6bd86d973775d31fc19b96a7a399e44c4b17afdadc4f46334d09
MD5 hash:	1230e0ace5d5d544fadd1440b29db026
MIME type:	text/plain
Signature	ACRStealer

File name:	SnP-Relaned.h
File size:	5'959 bytes
SHA256 hash:	6ec91a787285a7b29874344523cb587b8691c124b9e4d184c0c7973ead8dc196
MD5 hash:	149d1186ccf05bdee3afc067942d1dde
MIME type:	text/x-c
Signature	ACRStealer

File name:	DisplayLanguageNames.es_EC.txt
File size:	33'844 bytes
SHA256 hash:	0d1e76dbbc5962672a1e38893a2c7c0fa6539b294c884de924581f4747a543d0
MD5 hash:	79b39d08d13275e1385207554b5334d7
MIME type:	text/plain
Signature	ACRStealer

File name:	mc_trans_video_imagescaler.dll
File size:	338'632 bytes
SHA256 hash:	7477d95ce37cf920a420df3a0e04b95c1971d317420b543fb9235d4a984f28a6
MD5 hash:	bea48568be193f5f2c9c485a3bda0736
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	mysqli_local_infile_directory_vs_open_basedir.phpt
File size:	2'049 bytes
SHA256 hash:	876b86e9a90592afa690907f11fad063171ecf1dfdec0eefc573434d9356213e
MD5 hash:	0ac798927da4b994087a04a8e0cb2887
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.DiagnosticsHub.SDK.dll
File size:	275'888 bytes
SHA256 hash:	589845a6d20f455baba3268bca68036940e14619236ab8ad9cd9ae61ced3d1a1
MD5 hash:	e9c832b2c7302c30b36dafc2451d6a47
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	mail_basic_win.phpt
File size:	2'669 bytes
SHA256 hash:	19a1a9e09dd6d6e7de3bd66491c6aba1ef3f0be0df72f4469e98039c91828e52
MD5 hash:	6d33cf4438ca47dca48b8635d8f97b7a
MIME type:	text/plain
Signature	ACRStealer

File name:	antiword.exe
File size:	284'448 bytes
SHA256 hash:	d30a37489c64ada474d8d5aa5abb0778a6955d3ce6cdbb7c8c659e37b89d3da9
MD5 hash:	ef6b844dc543365bd6825d37dbbc04da
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	bug40451.phpt
File size:	467 bytes
SHA256 hash:	167e79d05d8c0dd12268ce0eaea8934f8fb4802749dfcd258e08a2c85bb2b292
MD5 hash:	7dbac0cffad0a6d14a0f36c57c47aa46
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.VisualStudio.TraceCollector.dll
File size:	244'264 bytes
SHA256 hash:	f7aa18ee77f02d27858b11b759a33c49ed9d051f18e11f23e3bbac999b97e5b1
MD5 hash:	44889b1594043c56504a57dcaa9f6048
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.VisualStudio.VirtualTreeGrid.dll
File size:	314'304 bytes
SHA256 hash:	d342bdf590631d3f6a8c84caddf460085102827f2409c049b1274d766bf19417
MD5 hash:	998bab9c30929322c18ab8e930f0015e
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	watch_002.phpt
File size:	637 bytes
SHA256 hash:	51d45d169ccc08d50b37c1291d3a14028b37454aa9e6d79474a125070eb77658
MD5 hash:	bece36a611a515370bb3f041b414df63
MIME type:	text/plain
Signature	ACRStealer

File name:	typemap011.phpt
File size:	1'614 bytes
SHA256 hash:	a0ff1ab18e2e9b332325fd0e3514b29642ee1eee3110fd57aea378751562d4e9
MD5 hash:	c1c8c30d221e36aee9155d2549178f32
MIME type:	text/x-c++
Signature	ACRStealer

File name:	iconv004.phpt
File size:	362 bytes
SHA256 hash:	32675d058712080ed50268a8a7e92b3eb8f3f57e32ddbb721edfd5dae68a5fd1
MD5 hash:	43b9ca621ed67a2d0dfa71febf8b1296
MIME type:	text/plain
Signature	ACRStealer

File name:	gettext_bindtextdomain-path.phpt
File size:	277 bytes
SHA256 hash:	02061fb64e4b39604a924c99c08437d1d0a084a8531dbe80969bbdc62b567bca
MD5 hash:	8e31cee5e90b1b48ab0abb1481f48321
MIME type:	text/plain
Signature	ACRStealer

File name:	go1.11.txt
File size:	25'579 bytes
SHA256 hash:	79923702f5e6da01437531ac175d220708df6a91dc537868b42203dd43283cb2
MD5 hash:	f0fdd5438157070f24ff18d1b3126974
MIME type:	text/plain
Signature	ACRStealer

File name:	curl_copy_handle_xferinfo.phpt
File size:	626 bytes
SHA256 hash:	0dd52a0fa0d38ffa5b1012b133c42ff96c7f39c9b0bb39e5477e1cdfdcbcf7a2
MD5 hash:	78cf0c34d189d9b3e4093241b876a136
MIME type:	text/plain
Signature	ACRStealer

File name:	tidy_error.phpt
File size:	635 bytes
SHA256 hash:	f7ce196900578e79c95df10f6dcdda8c5c8a6df9983094c870440fbf5cac4423
MD5 hash:	3616d3aa6de33e954c227769d4bca894
MIME type:	text/html
Signature	ACRStealer

File name:	bug74705.phpt
File size:	429 bytes
SHA256 hash:	3c77b74fc62c6b73a5d90c0ec7234938350c70dbfc72831692d27b238a416156
MD5 hash:	1e059dcaacf4ed09c6698683b87b22f5
MIME type:	text/plain
Signature	ACRStealer

File name:	timeout_variation_2.phpt
File size:	359 bytes
SHA256 hash:	fddb9e1dcd141dc226c5e4f393415be34c2be49e64648b17f758ccf4497a71ca
MD5 hash:	36da03785e551995beb99b66537c644f
MIME type:	text/plain
Signature	ACRStealer

File name:	parser.h
File size:	15'977 bytes
SHA256 hash:	c7feacb12b50b1eb3546969ae3681a81c52749547a133983e2dc0f53b6099915
MD5 hash:	fefd4951839cb7814d178e105f742a8c
MIME type:	text/x-c
Signature	ACRStealer

File name:	VSTOLoader.dll
File size:	370'512 bytes
SHA256 hash:	71358094547ecfac5e1758da3d2d36e5b7e72ba4bce23abd6459e6705740ed62
MD5 hash:	64f4e906ed3cc19cc87a6a2300cdbaf0
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	processing_instruction.h
File size:	1'712 bytes
SHA256 hash:	c8770011a57c7615dc656ac02539c7bbee03f5f0a8b7e35bcb839fd04207b393
MD5 hash:	8846e6afecb26e726b042ad732d6c527
MIME type:	text/x-c
Signature	ACRStealer

File name:	mod_query_empty.txt
File size:	2'760 bytes
SHA256 hash:	ef3ead45850808b1fdb7377c6b1263ce89c67732c48ab00d4babc9b40db430d0
MD5 hash:	a08d4ee58e9574ec428884f5dd30266c
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.VisualStudio.TestTools.UITesting.dll
File size:	484'744 bytes
SHA256 hash:	556b55966d9ccadd3b47801b92f707ad3967f6a283a28525d941983f0690aa48
MD5 hash:	90c375923a7ea3f761438db311af8c86
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	NativeCodeAnalysis.dll
File size:	243'136 bytes
SHA256 hash:	d51b59efb29daf1c8b9c24b0b40706a29bb84cb0e334f9cbdcd1b08df638b169
MD5 hash:	4cc4902d08a3577015789461ba0f9366
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.TeamFoundation.SharePointReporting.Integration.dll
File size:	217'496 bytes
SHA256 hash:	bbe3e13abf2079ff0c34b7daa529596a51be82e1bb08b43a7e0cde0e7c6dfc55
MD5 hash:	15c55709b732d585730fa6206fdb2f29
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Shandcloond.gqws
File size:	852'314 bytes
SHA256 hash:	5e749a55fdcd2dc018f5bb4f6c5a30d633c73a43814ac6572b8f0f210bbc80ee
MD5 hash:	11cb5ed0d1745ff46476dea5092117fa
MIME type:	application/octet-stream
Signature	ACRStealer

File name:	strtok_variation5.phpt
File size:	4'061 bytes
SHA256 hash:	d1570d8c0e94c19896bd410586fc647ad20865be59d50a1a6195b103245fe7cd
MD5 hash:	8dddee07795e074d88af74867f46113f
MIME type:	text/plain
Signature	ACRStealer

File name:	zend_multibyte-13.phpt
File size:	347 bytes
SHA256 hash:	4e5d7cbe8374a4d4ba2e32000e4fe0759386716c5760a3dcea7ed30dcaedc71e
MD5 hash:	488ae0c074df1692ff53696b10340661
MIME type:	text/plain
Signature	ACRStealer

File name:	getdate_variation4.phpt
File size:	1'940 bytes
SHA256 hash:	f41ade246b92b80de1db71b32f555c7fd0694f235c70cbd7beb264329b55a351
MD5 hash:	542b975145feb9c409612ed05367a780
MIME type:	text/plain
Signature	ACRStealer

File name:	typed_properties_064.phpt
File size:	1'616 bytes
SHA256 hash:	dc9c7bbe6b24132dc4a897384dee92ecf60bdc08b6c9155a2845ea7948fea373
MD5 hash:	096ef3c58d529ac9598ddf1b762071f0
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.AspNetCore.Mvc.Razor.dll
File size:	248'088 bytes
SHA256 hash:	60e332f6c7932785a48d9b48ac21a3fd252a10e446ed3f0386937f5ae28ea505
MD5 hash:	a8972550787af5efe5b12f9f43bb8a7c
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	mime_content_type_001.phpt
File size:	1'374 bytes
SHA256 hash:	679b7537be584aa17558a5629241231b4e9b7b53571130e2059f552423548acc
MD5 hash:	a6671b7ecc65268843a24eef1b9c6e51
MIME type:	text/plain
Signature	ACRStealer

File name:	lstat_stat_variation16.phpt
File size:	1'275 bytes
SHA256 hash:	53d55793ff7abb02f2f7005da67645ed0687ce8f27b1ebd9f9be8ad58f187517
MD5 hash:	b6b71378cb243b71449b3f124bbd104c
MIME type:	text/plain
Signature	ACRStealer

File name:	bug53511.phpt
File size:	580 bytes
SHA256 hash:	b7fd7c2552eeb50f729cd67c233ec4019002cbe3570e83560a842473384ff6d5
MD5 hash:	29b17ed70bb63791187f4378ab098a4d
MIME type:	text/x-c++
Signature	ACRStealer

File name:	black.dll
File size:	1'104'188 bytes
SHA256 hash:	0c9f29043439db30c5c99e0c2be17cb9caf160ec51354e97382399fb40b18fca
MD5 hash:	695f0b1fafffbc69a3680f67e33f51d5
MIME type:	application/octet-stream
Signature	ACRStealer

File name:	CloudMeService.dll
File size:	383'128 bytes
SHA256 hash:	740a4f09437f8dbced80ee926b2ae2b32011b9c83d491b938e543b57f2f1f174
MD5 hash:	297080371e5fb9eab1b6ad1c231b90ad
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Qt5Svg.dll
File size:	330'736 bytes
SHA256 hash:	7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 hash:	03761f923e52a7269a6e3a7452f6be93
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	NamedSequences.txt
File size:	20'776 bytes
SHA256 hash:	db5745688affcdc0c3927a1ee0667018a96a7b24513f866d5235e98fef6c2436
MD5 hash:	99a6784a1afc07f4b8e3f1e745f420e6
MIME type:	text/plain
Signature	ACRStealer

File name:	vccorlib140d.dll
File size:	1'478'016 bytes
SHA256 hash:	4b36e4caa3bcb59308c93cb11ae57ec5599f263546ab78bfb893b0418ad9971f
MD5 hash:	cea5b4628da1d9e7ba48c643b499a4fb
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	System.IO.FileSystem.dll
File size:	194'424 bytes
SHA256 hash:	334483bbea334b15f44c18be1fd4e4a8f34e5d912d25f188570f51bae951d722
MD5 hash:	1fb9136d2c7f467aeef3eeb387c019a8
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	index.txt
File size:	229 bytes
SHA256 hash:	d6ca8bbf4c3d3eb40a5873bd46eb6791426877bc0470430c45c1f1dd09ae7b5f
MD5 hash:	b224f1b1b29c668bfd95032e87d7a2d1
MIME type:	text/plain
Signature	ACRStealer

File name:	Stoutquaegbik.il
File size:	12'863 bytes
SHA256 hash:	6e681d98fe4e5efbdea571980359bc7ded13ff8a7dce86774737f555d44a1587
MD5 hash:	8967008917b0a4964fa8d30656f78079
MIME type:	application/octet-stream
Signature	ACRStealer

File name:	variants_x64.phpt
File size:	8'880 bytes
SHA256 hash:	73e795e90ba6fc22c587d4ba69f1146091b1372851927b9afe7d470e2bb280cf
MD5 hash:	fa6b44365a7b127f77c2a334daa2dce9
MIME type:	text/plain
Signature	ACRStealer

File name:	Qt5Qml.dll
File size:	3'362'192 bytes
SHA256 hash:	3c0d2efa6590d4816548b7b781eed0e634382edb343b48f584b9703ab2f340b3
MD5 hash:	1884953adf8ceb969b957a462ec99a91
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	043.phpt
File size:	4'629 bytes
SHA256 hash:	df7e023d18ff55f596529b2e203e1fb62980cf368e85c74cad5998b646cfc623
MD5 hash:	b29bc65a670ecc014f684ca78d113aaa
MIME type:	text/plain
Signature	ACRStealer

File name:	r4_groupH_simple_doclit_013w.phpt
File size:	1'384 bytes
SHA256 hash:	c9ee1966075396d8b79bfeb772b9dcbd04b919a7fd50cca32c860365c685c013
MD5 hash:	ca46ff5ed222728ff535fd85baeabe49
MIME type:	text/plain
Signature	ACRStealer

File name:	bug71572.phpt
File size:	742 bytes
SHA256 hash:	cce116c5f9bd7531806945c2dc54514b22f7e9b93760d6fded22586e17f87fa9
MD5 hash:	eb3a2ab890fbe67f856489c093e4516e
MIME type:	text/plain
Signature	ACRStealer

File name:	bug50005.phpt
File size:	330 bytes
SHA256 hash:	ab84d0b67d40cc0b09b34f6755a2f7d2692ceb6307c6fdab7fbf4caf9aac05cb
MD5 hash:	f99d7089c7b2b0105268d3ee4031216b
MIME type:	text/plain
Signature	ACRStealer

File name:	ahost.exe
File size:	50'215 bytes
SHA256 hash:	f5bce745ed86d899da269be477ffd36d3f017a8fb43c82fc7e22cd227d76d586
MD5 hash:	15696a8a5556dc93b61a4cb89637a042
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.Build.Tasks.Core.dll
File size:	1'411'184 bytes
SHA256 hash:	add2702e4db11c8bd8ceba8fce716f7443763599e188d2c9ff7c7f8e0cb8df53
MD5 hash:	5b0621ac07b96b85e3bd96ef6e0a384d
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	PPI-NVIDIA.dll
File size:	307'488 bytes
SHA256 hash:	c0f59470a7613227be04707621e469e2fa55ba3b09c7b23aa6d415e08a0f8d1b
MD5 hash:	21ed61ddde58eac12a7336e14d62e3eb
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	NuGet.DependencyResolver.Core.dll
File size:	223'496 bytes
SHA256 hash:	f7461e3f4f71c19a26ff0639dc4491b937d0ce539ad41a298c6e11aeffe85a0b
MD5 hash:	8d65a74c14011430cbd4a9e388d20f2f
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.CodeCoverage.IO.dll
File size:	817'424 bytes
SHA256 hash:	81afb23795b9d6c6351ca37a3b2430857b4ae1bf5ea353cea9223f0b102091a2
MD5 hash:	4b202332fa60ba4e9dd7f488b51845ba
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	AdobePIP.dll
File size:	488'648 bytes
SHA256 hash:	0d0caaf6c9647a7962bb13d6fb4d06800722dfd52e3695895366b1917689c3e9
MD5 hash:	18687ab631c41b3c5f838d341bf6418f
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	errmsg_036.phpt
File size:	222 bytes
SHA256 hash:	8415cbbc75098e968f666cce5e398683f10e3711d4b924e6e597eaeb2364d5c9
MD5 hash:	ab0bd25f31f96f5747ba7bc75e86e379
MIME type:	text/plain
Signature	ACRStealer

File name:	asinh_variation.phpt
File size:	716 bytes
SHA256 hash:	b0d1c310507c36e82cbb49f4fe42d0dcaba8f966f3665ef8789a36abc4bad12b
MD5 hash:	c5a2bac1f1f3d0b508cac5a79ac9cb8d
MIME type:	text/plain
Signature	ACRStealer

File name:	php_ini_builder.c
File size:	2'805 bytes
SHA256 hash:	eedfba6d94b592f6f09d1cd0d6f3b9d62d1abfd117a54990d03786755cfae293
MD5 hash:	d34c361e2a78a3d701570c4a1ca54f18
MIME type:	text/x-c
Signature	ACRStealer

File name:	list10.txt
File size:	247 bytes
SHA256 hash:	29e3517c053a9b20619f85db7419141595f840092562ae34ab045b70c53e683b
MD5 hash:	b129af1ff93987b40f6eb6dfe48c0ff2
MIME type:	text/plain
Signature	ACRStealer

File name:	lib_TSCommunication_sdk.dll
File size:	1'134'864 bytes
SHA256 hash:	9e08e9c16bb2b5f02bf7c9122f0460eed720827bae8e9c826dc6463c98ae4ca9
MD5 hash:	baca87b0b1135ee07f1cd7a7fa06671e
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	basic.txt
File size:	266 bytes
SHA256 hash:	1324e0ec19ab2363d01fc8362c2a4f60f0c7695a827a7c198b4c8cc509ab8f9f
MD5 hash:	cd8731e6e98972ffc451eb0e69a6fd84
MIME type:	text/x-diff
Signature	ACRStealer

File name:	MemoryProfilerCollectionAgent.dll
File size:	214'552 bytes
SHA256 hash:	8e66166c0f0420ec8846f0f0a4f14e32952a1d4fb93ad86ceee2cbd92e8084ff
MD5 hash:	aacd58984dda57a5ff787a2ee8cca76b
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	MOG_Framework_2.2.14_vc10.dll
File size:	308'936 bytes
SHA256 hash:	6686a74882961a361d49ee8da80b18939fad230fd5aa8a10dad16253b31aed68
MD5 hash:	dba793bc86370520da5028125ffbcf81
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	bug67118.phpt
File size:	879 bytes
SHA256 hash:	dce522aa0fbad54a4ac565c9d65b6d42b919958aab4b34b8be64b85f925e659a
MD5 hash:	28fe0eb0365b213e6968c45bceb1f604
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.VisualStudio.Text.Core.Implementation.dll
File size:	371'080 bytes
SHA256 hash:	7f201c6f400060cf731ce5bec46776b59d536c8594296e70fdcc18669910af38
MD5 hash:	9d1b27f754e6ce5cd6c7da67b7c9c120
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Microsoft.CodeAnalysis.AnalyzerUtilities.dll
File size:	543'624 bytes
SHA256 hash:	27300b349ae0c552ccb9bea18baf55b1fc99a517b0d4e15e557af4d3a4bff119
MD5 hash:	d884b1cf4b6bd49da730444d53492a2d
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	_Fs.dll
File size:	304'591 bytes
SHA256 hash:	b2a124e9f0e45df257ebb1a64e061aff7180fe84a860bf31cf7a1b4648163df1
MD5 hash:	a0b60ef82c26e13ac0c0273a29543244
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	onnxruntime.dll
File size:	2'424'384 bytes
SHA256 hash:	d77197d99ddb09255a08570a4542a1b8618f5e7e9760716ed08bf1d90fe3a8f3
MD5 hash:	a101d1ece6b707dcee70025c602e61fb
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	mod_get_trailing_slash.txt
File size:	982 bytes
SHA256 hash:	d4adc272b6e17cb0380421d9cd3e7d7d8651b20d4124b2269ba0812bb8630a98
MD5 hash:	d69f4e36a8846ec4e1687de8f3716a99
MIME type:	text/plain
Signature	ACRStealer

File name:	Microsoft.XmlEditorNeutralUI.dll
File size:	394'648 bytes
SHA256 hash:	fe6ad85d01b2bf03221f1af550d4c5dda903bead75a7412b4bec52ea1945a0e6
MD5 hash:	fcd1947ebfaa229a94470b3e12c6aa26
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	gmstrftime_variation7.phpt
File size:	1'772 bytes
SHA256 hash:	84002f358c88a2a037f46828675396d7e34e50eb65125c61d2c05e0759402288
MD5 hash:	7ac12301294e29786dc940349a901586
MIME type:	text/plain
Signature	ACRStealer

File name:	msvcdis140.dll
File size:	1'463'728 bytes
SHA256 hash:	bf43236b8c3e97610e973ef77b7cc7d949b20979d1d30970f1f9636cadb87be3
MD5 hash:	c3f793fcfad3a6f351f00445305d21d1
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	WzWXFlc64.dll
File size:	623'256 bytes
SHA256 hash:	6f4fbaf934f43db4556500d82521d19db539e5c8ae5cb5bce812af145d8b3261
MD5 hash:	0240af87a82624fe412d7ffdd950a1f6
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	VS_2019_Preview.txt
File size:	17'914 bytes
SHA256 hash:	df06bf7ef38347ec36e10bae30c4f9749c0ee48a414ae7f0f05dc48c089c750c
MD5 hash:	7b96a17a0e75e10630ce4d27f9d858c5
MIME type:	application/json
Signature	ACRStealer

File name:	swresample-progdvb-4.dll
File size:	222'944 bytes
SHA256 hash:	ae63d03da1e67a8eae18a87d720ff45e89ce984db0a9e30a4d39694370fd3d0d
MD5 hash:	6abc11ced54a1cf6dfa25c76f133bccb
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	pythoncom26.dll
File size:	489'472 bytes
SHA256 hash:	72a58e5544d30fc7dfeb91add2ac4fc88eb4dceb77cdd8a51944f5d9141fa34f
MD5 hash:	4c050c0bf4f8d8e832e4a1bc018f92f3
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	array_sum_basic.phpt
File size:	848 bytes
SHA256 hash:	5f508f87e4b04c5f32eda27ada0601440dff8ac823e71cd86a581c1f0152c893
MD5 hash:	0896dbaeb842c940971d474b4f53db91
MIME type:	text/plain
Signature	ACRStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68dc31457d643f33eab8dfbd

Tags:

injection obfusc crypt

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2025-11-08 13:00:52 UTC

File Type:

Binary (Archive)

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jltvjhjbney2mqklqqt3xwhnfyxhtu5gdos43khc4aag47gwaawa._file

Result

Malware family:

hijackloader

Score:

10/10

Tags:

family:hijackloader persistence privilege_escalation

Link:

https://tria.ge/reports/251108-s3rn5s1jgp/

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

7z 4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c

(this sample)

Link

https://tria.ge/251108-ppf4psypbp/behavioral3

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample