MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a
SHA3-384 hash:	6e0df12c8543ef122257bb937c3cf04e59bcd84deeaf7b49c017db687ab2efbda5d4dd7cb0cfc3929c6f0f6966e85057
SHA1 hash:	cb3f6a3214ebb2710b35a363c07347cacc810429
MD5 hash:	7270e484bc8c551241ca5cbd674f1d44
humanhash:	echo-delta-ohio-robert
File name:	stage1.ps1
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	6'853 bytes
First seen:	2026-03-24 10:28:44 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	192:rCP28BhakWrr/yLKiJ3jKcfCZVqSYdJ8v2GkxT2KqmFhyMCh:GP28BhakWrr/yui9KKCZgSYdJdGEqDoq
Threatray	61 similar samples on MalwareBazaar
TLSH	T18AE1107DAA79ECC403EEB0D05AA63E0620595B63D371196CF9D908D62D782C8DF3E24D
TrID	50.0% (.INI) Generic INI configuration (1000/1) 50.0% (.JSON) JSON array (generic) (1000/1)
Magika	powershell
Reporter	smica83
Tags:	ACRStealer HUN ps1

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

YARA.SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1.UNOFFICIAL

YARA.SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c26781390b99647413355e

Tags:

ransomware shell sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 obfuscated obfuscated powershell powershell

Link:

https://www.filescan.io/uploads/69c2677c2000fc76c3fc1b66/reports/34cbea92-7f1c-449f-a9ac-5b9ac7655ddb/overview

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.541

Link:

https://www.hybrid-analysis.com/sample/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a

Verdict:

Clean

File Type:

ps1

Link:

https://opentip.kaspersky.com/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a/results?tab=lookup

Result

Threat name:

Amatera Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1888169

Signature

AI detected malicious Powershell script

Creates a thread in another existing process (thread injection)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Amatera Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a

Threat name:

Text.Browser.Boxter

Status:

Malicious

First seen:

2026-03-23 18:29:56 UTC

File Type:

Text (PowerShell)

AV detection:

7 of 24 (29.17%)

Threat level:

4/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uuhgj6ywpe4vxv3cppaicg3jz4at75ecxsns7ys5dvxcj7buejna._file

Verdict:

malicious

Label(s):

amaterastealer

ACRStealer

3d7e9e61ddc414e65a76eb579c0fa65edb1298d4b000b85105c7b7aad468b1d2

ACRStealer

430b69b2268bb1f2f0821c8cf65d648917e1d13fd5c6f945b5830534e1d0e559

ACRStealer

48e54b857db34dfeae0879195df4861a7d2818f6e736967e056761b4451cf4f7

ACRStealer

5c81dcd6c3824436c1997ed858bf562e5d97584d14a88269f1553d211cdd9e15

ACRStealer

8ac1c5ccafeaac4bcd19d9ca5f182980e00cd6c5fba048990e21c5fd6623c820

ACRStealer

c69284960d9e928c6d051c3787e28d620963201873b59ec2637331640cd0677e

ACRStealer

ebb03085c9091d87e29f79ffc36f35277aaf46ec4356abf29c3bc93e87e8cd82

ACRStealer

error

ACRStealer

+ 51 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution phishing spyware

Link:

https://tria.ge/reports/260324-mjcg8ahz8n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

A potential corporate email address has been identified in the URL: pWGKGa@k.to

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	SUSP_PS1_FromBase64String_Content_Indicator_RID3714 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious base64 encoded PowerShell expressions
Reference:	https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639

Rule name:	SUSP_PS1_JAB_Pattern_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:	Internal Research

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)