MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 6 File information Comments

SHA256 hash:	9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89
SHA3-384 hash:	60f04366b4e67e43e0571ab772ab85571eeba734198ecb0752a1d4816041ca42c2f0327d62bb366446d7bcc4ad6d85dc
SHA1 hash:	5433000801c0ab668fac4e0e7767da41fb57afdc
MD5 hash:	da35353ac3a53d7b5618860717a81d0b
humanhash:	muppet-ten-pizza-princess
File name:	MicrosoftEdgeUpdate.exe
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	750'592 bytes
First seen:	2026-11-04 20:25:10 UTC
Last seen:	2026-11-04 21:22:42 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	12288:wasHUuZbMUENYb3dSGzLWOEcMPl9qIC9KEmEB001G2kYk4/tL5oN:wpHr7EqhdMPjc59001ZkYd/tL6
TLSH	T1C1F4AE44E9D382F0EE42647A715FF32FEFA15F01D826CAD5D7F82882D862350692F985
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	ghozt
Tags:	ACRStealer

ghozt

Embedded payload statically unpacked from install.ps1.

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-04 20:31:34 UTC

Tags:

stealer

Link:

https://app.any.run/tasks/640395e5-c63c-4c03-b8b6-b76a2a67e344

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/97232/

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aeb94ab7d28ff7e598cadd5

Tags:

adapter virus ordin lien

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context masquerade packed

Link:

https://www.filescan.io/uploads/6aec1e3a6cd17970eb31fead/reports/095d5e03-e4a3-4268-bba6-21b31ace4beb/overview

Verdict:

Malicious

Labled as:

Yogi.Generic

Link:

https://www.hybrid-analysis.com/sample/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89

Verdict:

Clean

File Type:

exe x32

First seen:

2026-11-04T19:54:00Z UTC

Last seen:

2026-11-04T21:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8a352cf3-6eb2-4992-8636-9f113e30b922

Result

Threat name:

ACR Stealer, Arechclient2, NEEDLE STEALE

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1998499

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Early bird code injection technique detected

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Monitors registry run keys for changes

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell connects to network

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queues an APC in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Windows Binaries Write Suspicious Extensions

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected ACR Stealer

Yara detected Arechclient2

Yara detected NEEDLE STEALER

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/da35353ac3a53d7b5618860717a81d0b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89/

Threat name:

Win32.Trojan.Sonbokli

Status:

Malicious

First seen:

2026-11-04 20:26:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t32n4bnyqonilh7ears6h47hg6pf37ikmyeqb2zchxlzoqhlz2eq._file

Verdict:

malicious

Label(s):

Amatera

Link:

https://reports.threatray.com/42033fcf-3f99-4f9a-abb2-bf858cf69181

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion discovery privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261104-y7dkzazw3l/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Time Discovery

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Family:

n/a

Verdict:

Malicious

Tags:

stealer

YARA:

pe_no_import_table

Link:

https://app.threat.zone/submission/339f0ac4-1c4c-4b4f-b8fc-014bc64685f3

Malware Family:

yogi

Malicious:

True

Tags:

checks-network-adapters spreader obfuscated

Link:

https://intel.virussign.com/intelligence/file/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89

Unpacked files

SH256 hash:

9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89

MD5 hash:

da35353ac3a53d7b5618860717a81d0b

SHA1 hash:

5433000801c0ab668fac4e0e7767da41fb57afdc

Link:

https://www.unpac.me/results/8d938cf5-015e-43f5-ab11-d4ff12085975/

Malware family:

ACRStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9ef4de05b883/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9ef4de05b8839a859fe40465e3f3e7379e5dfd0a660900eb223dd79740ebce89

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.