MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
SHA3-384 hash: 0258486f4e119f086a3b19bace64c8635d2a3e84122315d00ce445d3591a52a26113ba59753b384890932b1a570c36b4
SHA1 hash: 3eb4bb383af77b3169b4c7a699ebb1970f7cd9dc
MD5 hash: a77fd3f28ebe56694feabe00b22d7085
humanhash: juliet-november-wyoming-mountain
File name:a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
Download: download sample
Signature ACRStealer
Create hunting rule
File size:1'023'488 bytes
First seen:2025-08-27 07:28:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:BWsnU5Snm8jIiiVCaVyWUYEGTnGyhJPyPJvIoi9:MSmkiyWPEipJKPJvIR
TLSH T1CF252308AB152231E37C653F2D281314D5A4E2013B66FBAFDE99608983977A77711EF3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Anonymous
Tags:ACRStealer ClearFake exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
NO NO
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
Verdict:
Malicious activity
Analysis date:
2025-08-27 07:30:43 UTC
Tags:
stealer arch-exec hijackloader loader arcstealer
Link:
https://app.any.run/tasks/0abf7ee3-910b-4ded-8aec-d3480eae1ad2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23788/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68aeb3e2eb163e0ec182d43d
Tags:
micro spawn sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
DNS request
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated packed
Link:
https://www.filescan.io/uploads/68aeb43a39a6221faa706614/reports/c2cabc26-09d8-4add-8c19-93c552f6a5f7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/29e25501-9101-4b8e-b339-6829fc3e91a6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc/
Threat name:
Win32.Spyware.Acrstealer
Create hunting rule
Status:
Malicious
First seen:
2025-08-27 08:27:07 UTC
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulxnlqxxipyhhgpxbw2t2k7owfmuwwcceqharuck3lkaxzmcac6a._file
Verdict:
malicious
Label(s):
amaterastealer
Create hunting rule
Similar samples:
error
ACRStealer
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader defense_evasion discovery loader spyware stealer trojan
Link:
https://tria.ge/reports/250827-jbjd1sxnv3/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Badlisted process makes network request
Modifies trusted root certificate store through registry
Detects HijackLoader (aka IDAT Loader)
HijackLoader
Hijackloader family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3f049cb4-b48c-4ed8-9c37-945ae25318e8
Unpacked files
SH256 hash:
a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc
MD5 hash:
a77fd3f28ebe56694feabe00b22d7085
SHA1 hash:
3eb4bb383af77b3169b4c7a699ebb1970f7cd9dc
Link:
https://www.unpac.me/results/d6b653ee-60a9-4c33-aae3-34ba041944d7/
SH256 hash:
d6ef6def08c7329f412cfcde6e47a197925407c68b4c7dd22f5095a909db8541
MD5 hash:
70457541a8f8361c7e882d7d0354125a
SHA1 hash:
91ed71bac634b9193c5af7dfcdf15081e45e08e9
Detections:
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/d6b653ee-60a9-4c33-aae3-34ba041944d7/
Malware family:
GHOSTPULSE
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a2eed5c2f743/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a2eed5c2f743f07399f70db53d2beeb1594b5842240e08d04adad40be58200bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Exploit_Generic_008359cf
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_ACRStealer_f9728d76
Create hunting rule
Author:Elastic Security
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23788/

Comments