🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12
SHA3-384 hash: 017d0b788b94866d93abceeb8cda592ec3731957c6711eeedf30b7baf3622ebd02b9210209e016444228e66e4ca68416
SHA1 hash: f6bff5ebf13d5b2ce12fe74d6a6d605d116c41eb
MD5 hash: 8e01a3320ad9f46be1e69d2c889628cc
humanhash: thirteen-glucose-utah-fix
File name:sqlite3MM.dll
Download: download sample
Signature ACRStealer
Create hunting rule
File size:7'682'688 bytes
First seen:2025-10-04 00:24:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 644eba807aea177bec976727225315d6 (2 x ACRStealer)
ssdeep 98304:IP4jvE6/rGxBFJKmBGOVRfeVY9oHlbPJUeDRjkQpBoUGoXLJGF3pXmB3i2Wrf9s7:y/6TYG2RWVvHlLr9LoUjXFGDXmBuaGyv
TLSH T12E761206EB928075F8C300FAD77B05FD2B756661038588EB2AC579C4A761EF63837963
TrID 30.2% (.EXE) Win64 Executable (generic) (10522/11/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4504/4/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter aachum
Tags:178-156-192-62 a9321e ACRStealer Amadey dll HIjackLoader IDATLoader signed

Code Signing Certificate

Organisation:www.uggub3em5uf1.io
Issuer:www.uggub3em5uf1.io
Algorithm:sha512WithRSAEncryption
Valid from:2025-04-18T14:19:12Z
Valid to:2035-09-30T14:19:12Z
Serial number: 2043c1c7d9e18e30f1721755f79ce93b
Thumbprint Algorithm:SHA256
Thumbprint: 3491e535bec26f97f0d5a4d09837fa04d4839829be5560560ad7d547cd3b4a89
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
https://disk.yandex.com/d/emnrYDgVwi0ajg

Amadey Botnet: a9321e
Amadey C2: http://mi.barbertingling.com/kaWt2QXfpPueNM/index.php
ACRStealer C2: 178.156.192.62

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
ES ES
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/30088/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e06462d707128ed1ebfb4a
Tags:
injection obfusc agent
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed packed purebasic signed unsafe vmprotect
Link:
https://www.filescan.io/uploads/68e069445a3bccf09eb73e90/reports/b9e2c6ef-c970-4ed5-bcc6-6890af87dcbb/overview
Verdict:
Malicious
Labled as:
Malware_58.1
Link:
https://www.hybrid-analysis.com/sample/a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12
Verdict:
Unknown
File Type:
dll x32
Link:
https://opentip.kaspersky.com/a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cc092d34-c857-4f1a-99de-5c342b912fe8
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1789075
Signature
AI detected suspicious PE digital signature
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Switches to a custom stack to bypass stack traces
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1789075 Sample: sqlite3MM.dll Startdate: 04/10/2025 Architecture: WINDOWS Score: 60 31 AI detected suspicious PE digital signature 2->31 33 Joe Sandbox ML detected suspicious sample 2->33 8 loaddll32.exe 1 2->8         started        process3 signatures4 37 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->37 39 Switches to a custom stack to bypass stack traces 8->39 41 Found direct / indirect Syscall (likely to bypass EDR) 8->41 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        16 rundll32.exe 8->16         started        18 21 other processes 8->18 process5 signatures6 20 rundll32.exe 11->20         started        43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->43 23 WerFault.exe 20 18 13->23         started        25 WerFault.exe 16 16->25         started        27 WerFault.exe 16 18->27         started        process7 signatures8 35 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 20->35 29 WerFault.exe 16 20->29         started        process9
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/8e01a3320ad9f46be1e69d2c889628cc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-04 00:13:43 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4p3yd37hw6cx4aqvrxclx7jmwsnwbftb2f3qhbbqbca7hhczyja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251004-aqceksgl21/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12
MD5 hash:
8e01a3320ad9f46be1e69d2c889628cc
SHA1 hash:
f6bff5ebf13d5b2ce12fe74d6a6d605d116c41eb
Link:
https://www.unpac.me/results/d868c5d4-30e3-49b6-8e9a-83a5b966e0aa/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 806396a467cb93d01391a981cf7d252573fe0b4f0fff0769e4aed3602889f813

ACRStealer

DLL dll a71fbc0f7f3dbc2bf010ac6e25dfe965a4db04b30e8bb81c2180440f9ce2ce12

(this sample)

  
Dropped by
SHA256 806396a467cb93d01391a981cf7d252573fe0b4f0fff0769e4aed3602889f813
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/30088/
  
Dropped by
MD5 879889dbc08fe007e998b973546fc447

Comments