MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6
SHA3-384 hash: 95c25166afcb854ad23314cc9fb806c29aedd6c35374cafd27d79b9e7285a5a638ffbf4902cc97438887cbb4944b62bb
SHA1 hash: 10e9ba5759a7b6d634131dcfaa82d1bc5166290b
MD5 hash: 43cfe8c8eb8dd91853d7e16b4b633aa4
humanhash: montana-quiet-saturn-bakerloo
File name:SETUP.zip
Download: download sample
Signature ACRStealer
Create hunting rule
File size:2'167'133 bytes
First seen:2026-03-14 15:23:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:zZVZwvojaFmlwXaLrRYkT0fZThLV/CgquxLHxH:HhaFomKL2nV/CWd
TLSH T121A5239E723605F4EBED84B92B95070B57D28734CE2E27554A7C14AE3E35A8A4C8DC0F
Magika zip
Reporter aachum
Tags:185-177-239-151 ACRStealer AsgardProtector CountLoader file-pumped zip


Avatar
iamaachum
https://bhgcfdt.cfd/ => https://disk.yandex.com/d/4UVxIwqdqO7nAw

ACRStealer C2: 185.177.239.151
CountLoader C2: https://geo-foundation.vg/

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
ES ES
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Setup_Installer.exe
File size:104'857'600 bytes
SHA256 hash: 9b70fbeed0d892925b0645946bb9026fb92453a8cef0ee045d85e575ecdf32b0
MD5 hash: 0244db4226aa3558f1689c2acfd43d35
MIME type:application/x-dosexec
Signature ACRStealer
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c45da003-d4c7-4b93-91e3-c9ed5bf7bfdb/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b57da488c80c01586a0a04
Tags:
autoit emotet
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit CAB expand installer installer installer-heuristic lolbin lolbin microsoft_visual_cc rundll32 runonce sfx
Link:
https://www.filescan.io/uploads/69b57d9f2000fc76c3dd1bb3/reports/4c0ff846-da53-4fc0-aee3-63e81be55c90/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6
Verdict:
Malicious
File Type:
zip
Link:
https://opentip.kaspersky.com/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6/results?tab=lookup
Score:
77%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/43cfe8c8eb8dd91853d7e16b4b633aa4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6/
Threat name:
Win64.Trojan.Etset
Create hunting rule
Status:
Malicious
First seen:
2026-03-14 14:49:39 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucj5mxjpuhve5v6dl6xh3ohkpwakozgh4wnxesaopr37aqpgwx3a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
adware discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260314-sxtxbahs6j/
Behaviour
Modifies Internet Explorer settings
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Deletes itself
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Badlisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://geo-foundation.vg
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6

(this sample)

ACRStealer

Executable exe d955546f64e68c8e9f70b08608b414ee6993dc0ecd8a362a94271160c208b7fe

  
Link
https://tria.ge/260314-scw6yaaz5v/behavioral2
  
Dropping
CountLoader
  
Delivery method
Distributed via web download
  
Dropping
SHA256 d955546f64e68c8e9f70b08608b414ee6993dc0ecd8a362a94271160c208b7fe
  
Dropping
MD5 c045a48123dddaca1656bb5d389d3509

Comments