MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 6 File information Comments

SHA256 hash:	87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec
SHA3-384 hash:	6889cc130e297ba20004dbf5ceccd431fc7e110a65d340cc3d2c5cb381823de53514ed8aae0f5bdf6f8f6881ede79957
SHA1 hash:	c54fa636abfa0be3f08f5a2d98769069be1725b1
MD5 hash:	bc9261500b8fd7964dfc45a4ed9eb291
humanhash:	colorado-lima-robin-fourteen
File name:	sunwukongs.exe
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	1'261'536 bytes
First seen:	2026-06-04 06:00:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:hCB8k93bngAaRjm98wKaLCmmVoPAi6xi41Hwk+pQ8puMlqcHZ5dId2:0f9riRjCKQC1QAnxP2Q8wMlqch
TLSH	T1C445E0DF58998895E494B4B915317F1AC17DFCC90AE066CF57BB3034A23CE812A2D7AC
TrID	21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 21.2% (.EXE) Win64 Executable (generic) (6522/11/2) 16.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 14.6% (.EXE) Win32 Executable (generic) (4504/4/1) 6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	70d4e8d4d4e8d460 (1 x ACRStealer)
Reporter	abuse_ch
Tags:	ACRStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

143

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2026-06-03 18:39:37 UTC

Tags:

auto metasploit framework python ipfs phorpiex botnet phishing massbass screenconnect tool rmm-tool remote github possible-phishing loader quasar rat rustystealer stealer generic clickfix tinynuke koiloader action1rmm santastealer telegram pastebin susp-powershell ip-check evasion arch-doc rustme keylogger xenorat networm amus bruteratel gh0st njrat payload meterpreter cobaltstrike donutloader redline whitesnakestealer discord adware remcos qrcode valleyrat silverfox winos pushware asyncrat bladabindi ghostsocks proxyware vidar coinminer miner whitesnake pythonstealer amadey dattormm xworm ransomware cryptolocker stealc remusstealer putty websocket upx neshta lumma eicar-test

Link:

https://app.any.run/tasks/ebccb6d4-54ac-4d56-84e7-ea73a714f519

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68941/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.82144726.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a211495f8676ad4d360e9db

Tags:

injection phishing obfusc crypt

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

invalid-signature overlay packed packed signed

Link:

https://www.filescan.io/uploads/6a21148d46e44aecc0ce057d/reports/a91a723e-76bb-4a01-be18-20c8ead128c9/overview

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec

Verdict:

Clean

File Type:

exe x32

First seen:

2026-06-03T10:58:00Z UTC

Last seen:

2026-06-04T07:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec/results?tab=lookup

Malware family:

AtlasAgent

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/253ef053-4dd9-4376-ad77-13c574c0c99f

Result

Threat name:

ACR Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1922663

Signature

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected ACR Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

41%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2026-06-04 00:56:14 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q73f4e54dhchprcf73i2ncjj2fpcqdc3o5a72ulfs4vpi2gughwa._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260604-gqqersbt6r/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of NtCreateUserProcessOtherParentProcess

Unpacked files

SH256 hash:

87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec

MD5 hash:

bc9261500b8fd7964dfc45a4ed9eb291

SHA1 hash:

c54fa636abfa0be3f08f5a2d98769069be1725b1

Link:

https://www.unpac.me/results/2f73e17d-082e-4d89-8eeb-4d162780a321/

SH256 hash:

ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c

MD5 hash:

b0aa0fd9f9f0d6277da32d62bd825c73

SHA1 hash:

c92afcb56f203bdd26f556fdfc0f8b1fe336ec04

Link:

https://www.unpac.me/results/2f73e17d-082e-4d89-8eeb-4d162780a321/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/87f65e13bc19c477c445fed1a68929d15e280c5b7741fd5165972af468d431ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.