MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
SHA3-384 hash: e235f7af6fc37ad346995146bedc61de5f9f0491a79605951a4a35fa1f805c584eef794d98a5364f7fcbc43fc9263337
SHA1 hash: 74f9a02e35eb0e0898a74f4b5dc9de617d2acc3c
MD5 hash: e277407755614135535679b9d0d243c6
humanhash: venus-charlie-ink-orange
File name:setup_patched.exe
Download: download sample
Signature ACRStealer
Create hunting rule
File size:2'735'616 bytes
First seen:2025-02-02 13:19:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 73fc0ad667f8746f323df4a5c3b41b0e (6 x LummaStealer, 4 x ACRStealer)
ssdeep 49152:1hq2vCGO/gWTwNZhr7NtH+CoR8EwZ6YEfff5B:h1OoWTwxNItYaL
Threatray 2 similar samples on MalwareBazaar
TLSH T19FC5CF227342E131C26240B429ADEA6A606CE936CF2645CBE7F12A5DD7F01F11FF6647
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon dc9afa92bab2b2cc (10 x LummaStealer, 4 x ACRStealer)
Reporter aachum
Tags:ACRStealer de-pumped exe


Avatar
iamaachum
https://bjjky.cfd/ =>https://mega.nz/file/fTZGhLQQ#BZcdVuf4zLTdH9jlgMtfqAZxDYz-EnxMa_0ZgIqmbTA

ACRStealer C2: mm.underarmpresumingsubscript.shop

Intelligence

File Origin
# of uploads :
1
# of downloads :
477
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_patched.exe
Verdict:
Malicious activity
Analysis date:
2025-02-02 13:20:26 UTC
Tags:
stealer phishing arch-exec
Link:
https://app.any.run/tasks/cf5eb710-43c5-41ba-92ec-8d1b69700fd5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.1148.10328.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679f7110416a81ccc3c4fe74
Tags:
shellcode crypt lien sage
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context crypto evasive explorer fingerprint keylogger lolbin microsoft_visual_cc overlay packed packed packer_detected remote rundll32
Link:
https://www.filescan.io/uploads/679f710f3a4118f0a761504b/reports/cb39938c-746c-4ea1-899c-c87c2ba55c0e/overview
Verdict:
Suspicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2e0f80bd-aaf3-422b-b288-a0beb55cdbc6
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1605024
Signature
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ne3z5ms6kyzkhynugymyljxistqmoprjoia5f5gskgobjends4fq._file
Verdict:
malicious
Label(s):
idatloader
Create hunting rule
Similar samples:
34a4212ab10d2edc6a8894cc368807279fc7c200aec606c18eb6a0bf21350cb5
ACRStealer
69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
ACRStealer
error
ACRStealer
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250202-qk6dgavqbn/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Checks installed software on the system
Reads user/profile data of web browsers
Uses browser remote debugging
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/67be8a8d-3c95-4718-98a1-65b569feb7f7
Unpacked files
SH256 hash:
69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
MD5 hash:
e277407755614135535679b9d0d243c6
SHA1 hash:
74f9a02e35eb0e0898a74f4b5dc9de617d2acc3c
Link:
https://www.unpac.me/results/cb8d5616-3f25-48cd-b7de-86ca804dd5e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 4f99c8a02195d016caa7d648fbaeb9b19717ac5efa91caf20f9fa54898dbec5d

ACRStealer

Executable exe 69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b

(this sample)

  
Link
https://tria.ge/250202-qe8lmssqdt/
  
Dropped by
SHA256 4f99c8a02195d016caa7d648fbaeb9b19717ac5efa91caf20f9fa54898dbec5d
  
Delivery method
Distributed via web download
  
Dropped by
MD5 c2c31bcc36938378bd68fae4479b6423

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::IsValidSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaGDI32.dll::StretchDIBits
WINMM.dll::timeBeginPeriod
WINMM.dll::timeEndPeriod
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetSidIdentifierAuthority
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::SetProcessShutdownParameters
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetSystemDirectoryA
KERNEL32.dll::GetFileAttributesW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameA
ADVAPI32.dll::LookupAccountNameA
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextA
CRYPT32.dll::CryptBinaryToStringW
ADVAPI32.dll::CryptGenRandom
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegOpenKeyW
ADVAPI32.dll::RegOpenKeyA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::BlockInput
USER32.dll::BroadcastSystemMessageW
USER32.dll::FindWindowW
USER32.dll::FindWindowA
USER32.dll::FindWindowExW

Comments