🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7
SHA3-384 hash: 7486a6cd34543ba1d81acc751c3830bfb112ff389813681464d6537b40e7b9a3b3289bb8abe417c37359080067fd21da
SHA1 hash: b9a15c295706ed6258b4d82f87ca7e2fde89e71a
MD5 hash: c75f956fbb0c13ffe7cdd16892096911
humanhash: speaker-potato-batman-jupiter
File name:WS_Log.DLL
Download: download sample
Signature ACRStealer
Create hunting rule
File size:483'048 bytes
First seen:2025-10-04 00:21:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c59558b95aac4a50df7a2957696a0d97 (1 x ACRStealer)
ssdeep 6144:VoobMdVrKYT6/eBT81ZEvai8hf74ExVlwB9mmDlL/fJC2MLE:uobMd9KihvL6TA5L/pT
TLSH T111A44B57B75414A5D4678238C9938746E6B3B8F50B71878F03A8D3BA2F236D05E3EB21
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter aachum
Tags:91-99-71-177 a9321e ACRStealer Amadey dll HIjackLoader IDATLoader


Avatar
iamaachum
https://uutwmrw7.cfd/8C57NZNTJQF86RN7ICZR => https://mega.nz/file/6xBwHZCY#-O0maWPYzbUXlFDR4SLNFNEwvgd4pyWp5825WB7V9p4

ACRStealer C2: 91.99.71.177
Amadey Botnet: a9321e
Amadey C2: http://mi.barbertingling.com/kaWt2QXfpPueNM/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SaUp_Fre.zip
Verdict:
Malicious activity
Analysis date:
2025-10-03 20:07:07 UTC
Tags:
auto generic arch-exec
Link:
https://app.any.run/tasks/1b009fc5-a24f-43af-8425-ccad57078353

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/30086/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e068cfd707128ed1ebfef1
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 evasive expired-cert fingerprint infostealer invalid-signature masquerade microsoft_visual_cc overlay signed
Link:
https://www.filescan.io/uploads/68e068cad4a0085473bfe54d/reports/e4958f59-9d19-4886-8064-33998dc2f143/overview
Verdict:
Malicious
Labled as:
Infostealer/ACRStealer
Link:
https://www.hybrid-analysis.com/sample/57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7
Verdict:
Unknown
File Type:
dll x64
First seen:
2025-10-03T08:36:00Z UTC
Last seen:
2025-10-05T05:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4f682db8-6142-46d4-90f1-8af0f0c47e45
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1789077
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1789077 Sample: WS_Log.DLL.exe Startdate: 04/10/2025 Architecture: WINDOWS Score: 48 19 Multi AV Scanner detection for submitted file 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Score:
4%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c75f956fbb0c13ffe7cdd16892096911
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6kdeqf237e4ydqqji64byjc3d6qvaiuwa6vziofbciauvgni7tq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/251004-an7gya1pw6/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/03491bcf-c955-4fe2-a452-116087baa705
Unpacked files
SH256 hash:
57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7
MD5 hash:
c75f956fbb0c13ffe7cdd16892096911
SHA1 hash:
b9a15c295706ed6258b4d82f87ca7e2fde89e71a
Link:
https://www.unpac.me/results/1b6d588b-d446-41f7-ab7a-e1584dc09027/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 65140a6d591aa6a3bba491f9d352aad232dd8f34c724c363c3579e50736b6fa1

ACRStealer

Executable exe 57943240badfc9cc0e104a3dc0e122d8fd0a8114b03d5ca1c508900a54cd47e7

(this sample)

  
Dropped by
SHA256 65140a6d591aa6a3bba491f9d352aad232dd8f34c724c363c3579e50736b6fa1
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/30086/
  
Dropped by
MD5 0658fcae236be5b25bfc7c3766c639df

Comments