MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 747828f45b37244bdcf2d3ca88daa18649d7ad64d66339f9509a94b70a2930bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	747828f45b37244bdcf2d3ca88daa18649d7ad64d66339f9509a94b70a2930bb
SHA3-384 hash:	eebee2350f8f916bba6e12490e20732fd77bff3f12625767f7f1ef497d536046e2375b6204f0765bcfb910190d17f77d
SHA1 hash:	62e302c72f9a6b1dc1ca0258e7f03bf9d6dffc55
MD5 hash:	816f2983efbf6e9f2f630f62dc7108f6
humanhash:	stairway-fanta-carpet-failed
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	70'274'217 bytes
First seen:	2026-05-14 23:25:37 UTC
Last seen:	2026-05-15 20:30:33 UTC
File type:	zip
MIME type:	application/zip
ssdeep	1572864:DD/lH0KJYBXxY8uA/kWM3twdiXqV5AMRHrDIwKs8e06ZxkPAEtSvpo12o:vdH0bBXKA/5Mdwg4BdIxe09AEtSvo
TLSH	T1FAF733ED09A40A8A7F7B57FD152ACE059F7F845830A0EB5FDC6115A2B5E9C0DED0C0A8
Magika	zip
Reporter	aachum
Tags:	ACRStealer getauthdash-icu HIjackLoader IDATLoader zip

iamaachum

https://newlaps.org/ => https://www.mediafire.com/file/40wxz1jcndhb5ep/D0WNL0AD_SETUP_FILE(KEY_2113).zip/file

ACRStealer C2: getauthdash.icu

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c16c4f7d-c432-43e0-a33d-bb5151c63baa/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d0532c66ab6d001dce8516

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/747828f45b37244bdcf2d3ca88daa18649d7ad64d66339f9509a94b70a2930bb

Verdict:

Malicious

File Type:

zip

First seen:

2026-05-14T21:36:00Z UTC

Last seen:

2026-05-16T19:32:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/747828f45b37244bdcf2d3ca88daa18649d7ad64d66339f9509a94b70a2930bb/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)