🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 2


Intelligence 2 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49
SHA3-384 hash: 526d8ee774a1e2b236345b569a8e1d930388660394e21a5292d5c845dd655a163768e7710137f13c60a6ce7559337d37
SHA1 hash: 59efc2ec797e3715ce479bc37988ecb31295aafd
MD5 hash: 9fe549742092b9a1b32b0bd6e32ebc1f
humanhash: sad-venus-thirteen-quiet
File name:Iw8vmu-KMSpico.rar
Download: download sample
Signature ACRStealer
Create hunting rule
File size:19'421'950 bytes
First seen:2025-10-06 19:19:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
Note:This file is a password protected archive. The password is: windows
ssdeep 393216:OS11vRvpiLAkalB1ip2aRoulFfKQGcbeyDD/aaieKLF5qLbF9r:v1BpiLXEB1k2ayIFfBpXey9r
TLSH T1081733E2615B0ACA64659C44BFE303669CD3D268998DCD39F5EA2E74CC6CC312D37782
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter aachum
Tags:345b88 95-217-20-8 ACRStealer Amadey HIjackLoader pw-windows rar


Avatar
iamaachum
https://xcwd23esdooiwe.top/?t=7_KMSpico => https://asidjn324sadn399.top/

ACRStealer C2: 95.217.20.8

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
ES ES
File Archive Information

This file archive contains 35 file(s), sorted by their relevance:

File name:MSVCP140.dll
File size:462'088 bytes
SHA256 hash: ed979590d7d2a1444cbf936dab164c3c068be3f096a401fb0221895654a865ea
MD5 hash: 6743c0862deb4b7c0da01a2ae0e8877e
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-synch-l1-2-0.dll
File size:18'384 bytes
SHA256 hash: 9ac63682e03d55a5d18405d336634af080dd0003b565d12a39d6d71aaa989f48
MD5 hash: 659e4febc208545a2e23c0c8b881a30d
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-timezone-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: a108a8f20ded00e742a1f818ef00eb425990b6b24a2bcd060dea4d7f06d3f165
MD5 hash: 69df2cce4528c9e38d04a461ba1f992b
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-profile-l1-1-0.dll
File size:17'360 bytes
SHA256 hash: d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a
MD5 hash: 6ee66dca31c5cce57740d677c85b4ce7
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-process-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 542a22540cdb7df46d957a0208d50507916f7c737bea833931239d56ebe8d68c
MD5 hash: 66f4e530a19ed2f6862b5ce946437875
MIME type:application/x-dosexec
Signature ACRStealer
File name:NvStWiz.prx
File size:442'680 bytes
SHA256 hash: c2ad5bd189df04b39be18dec5cd251cf79b066010706ad26d99df7e49fd07762
MD5 hash: 9e82e3b658393bed3f7e4f090df1fbe7
MIME type:application/x-dosexec
Signature ACRStealer
File name:libcrypto-1_1.dll
File size:2'545'928 bytes
SHA256 hash: d65c5d3cc948fba62021f127d36efe743bf19ec8ad5fe5bbb4f532c40426c9ad
MD5 hash: 07348670892df4814eaa780341d4053d
MIME type:application/x-dosexec
Signature ACRStealer
File name:Fleed.ym
File size:33'672 bytes
SHA256 hash: ccce989c4633273a35d77a61cbd59ee9a559b5c45501f634411a709c2b03712d
MD5 hash: 18485e400a66c0008f3312228e4706a0
MIME type:application/octet-stream
Signature ACRStealer
File name:tradingnetworkingsockets.dll
File size:4'249'928 bytes
SHA256 hash: fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
MD5 hash: 3cf26ce759c5e261fe3ecc6451b8b08e
MIME type:application/x-dosexec
Signature ACRStealer
File name:BugSplat.dll
File size:474'640 bytes
SHA256 hash: db76dc771555a0cdea6edff09c5c2b1f371b623ebd20a170cf4d4dbdf8a9ebfc
MD5 hash: f8b943e98bc99e113bdaa1543ce6a496
MIME type:application/x-dosexec
Signature ACRStealer
File name:Activate.exe
File size:6'580'488 bytes
SHA256 hash: bd9f45337c13bcbd25151f8a06c8894990c7800a905ca1e53480e4d4c7eb7936
MD5 hash: 4630e379b1a865033c32742dafa29e95
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-private-l1-1-0.dll
File size:70'608 bytes
SHA256 hash: 696c10112d8b86a46e5057cbd0bf40728e79c6bb49cda1f2c67fe45d0fc1258d
MD5 hash: ad8d9a6ea592a6c8a78c67a805cec952
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-heap-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 0166edfb23cfc77519c97862a538a69b5d805d6a17d6e235f46927af5c04b3c9
MD5 hash: 9c373c00ac3138233bdf1655c7be8e86
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-util-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 68bd9c086d210eb14e78f00988ba88ceaf9056c8f10746ab024990f8512a2296
MD5 hash: c6553959aecd5bac01c0673cfdf86b68
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-synch-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc
MD5 hash: 979c67ba244e5328a1a2e588ff748e86
MIME type:application/x-dosexec
Signature ACRStealer
File name:VCRUNTIME140.dll
File size:87'304 bytes
SHA256 hash: 902afd4f542284f3f6fcf31481588e1caadb4d9d2d1460d9b8289ec8c3f49671
MD5 hash: 86274b94bf6551e126f2a4129a8a5d4a
MIME type:application/x-dosexec
Signature ACRStealer
File name:Brograeg.zo
File size:803'090 bytes
SHA256 hash: 30bc0a3d5815ef681c657737ccf02a0d81f0f759c1be2acfc6fbcd770621e7be
MD5 hash: 9bed69ace89224ce34c562a020e96dbb
MIME type:application/octet-stream
Signature ACRStealer
File name:api-ms-win-crt-math-l1-1-0.dll
File size:27'088 bytes
SHA256 hash: c7115159babdaa1f52e478e67b4e612da2332fda4e4036999b29425fe303b6e8
MD5 hash: bc418a3461c5fdfa1a0d75f7e03d08a7
MIME type:application/x-dosexec
Signature ACRStealer
File name:MSVCR90.dll
File size:656'248 bytes
SHA256 hash: d7566fb962532f1250eeb1149fd65a9f5abce97995cfa5b89d5cb8f502f08dee
MD5 hash: c57d4e31734fa87dc4d5dd236fbf534c
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-rtlsupport-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b
MD5 hash: 0069fd29263c0dd90314c48bbce852ef
MIME type:application/x-dosexec
Signature ACRStealer
File name:SoftwareLog.dll
File size:921'352 bytes
SHA256 hash: 52bace26571df089190dc3bdd652623ee893ad083260b97d97d846f11b70f9d6
MD5 hash: be408b7e8bb5804b8d01f0247ba2e19a
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-filesystem-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 85b1b189ce9e3c6f4d2efdd4cd82b0807f681bea2d28851caaf545990de99000
MD5 hash: 14f407d94c77b1b0039ae2c89b07a2ff
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-conio-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 4aeeae0ac9f6c1b0b8835067ea3b7fc429f353565f18de7858f4ea5d6f72072e
MD5 hash: 7190cbfad2d7773d3b88ccc25533a651
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-processthreads-l1-1-1.dll
File size:18'384 bytes
SHA256 hash: e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36
MD5 hash: 29001f316ccfc800e2246743df9b15b3
MIME type:application/x-dosexec
Signature ACRStealer
File name:trading_api64.dll
File size:289'568 bytes
SHA256 hash: f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
MD5 hash: 2bca4e2c047ec969cb3cff277e7fc184
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-sysinfo-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 1fe918979f1653d63bb713d4716910d192cd09f50017a6ecb4ce026ed6285df9
MD5 hash: cef4b9f680faae322170b961a3421c5b
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-convert-l1-1-0.dll
File size:21'968 bytes
SHA256 hash: 77b69e829bdc26c7b2474be6b8a2382345b2957e23046897e40992a8157a7ba1
MD5 hash: 3e415147ccd7c712618868bdd7a200cd
MIME type:application/x-dosexec
Signature ACRStealer
File name:lic
File size:7'340'032 bytes
SHA256 hash: fe5ce5cf1a0b9608f25a9d5b868ee57297cd47c911390e7e0ecec134ba83cfc7
MD5 hash: f48aaff8e316afe4534e4cd63844a1bc
MIME type:application/octet-stream
Signature ACRStealer
File name:ks_tyres.ini
File size:10'077 bytes
SHA256 hash: 894d3c57598ecb22c769cc3ea8219859a95e22740e72394a474012ea2119b3d9
MD5 hash: 47f6571c7884da6c743551ac724186d4
MIME type:text/plain
Signature ACRStealer
File name:LIBEAY32.dll
File size:1'038'088 bytes
SHA256 hash: 7b1daa56d4c0d3d57d042a16a9aef281ddad9f37d2816880abc133301c3e1b6a
MD5 hash: 62bf58122281bd6ce1c9935dde7d5adc
MIME type:application/x-dosexec
Signature ACRStealer
File name:libcurl.dll
File size:1'492'232 bytes
SHA256 hash: 07226300a651fc43738a494c2670899c75a41c66a11454f199dc5074709d3b14
MD5 hash: 212a1f3ce036433637ba94cccb0d21ea
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-locale-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: f16447b5fc7fe6fb8a6699a3cef1b2b8ba92d408579bcc272d3dd76acd801e2a
MD5 hash: c5d747f96237b6e9aa85c58745d30c80
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-environment-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: 6c9c0dc7b36afe07dfb07dd373fc757ff25df4793e6384d7a6021471a474f0b9
MD5 hash: ad0cbb9978fcf60d9e9ca45de6a28d30
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-core-string-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 3807db7acf1b40c797e4d4c14a12c3806346ae56b25e205e600be3e635c18d4f
MD5 hash: 2e5c29fc652f432b89a1afe187736c4d
MIME type:application/x-dosexec
Signature ACRStealer
File name:api-ms-win-crt-multibyte-l1-1-0.dll
File size:26'064 bytes
SHA256 hash: c6b4e1d903b3cc83bfaffbe4e82eee634cff8f97f12217caa45b464ddc4e1455
MD5 hash: 9e9c6f83a015029808f5257f7b7e39c6
MIME type:application/x-dosexec
Signature ACRStealer
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e41727277c2bd8bc5d08f3
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49
Verdict:
Unknown
File Type:
rar
Link:
https://opentip.kaspersky.com/b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Link:
https://app.malva.re/file/9fe549742092b9a1b32b0bd6e32ebc1f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgzdluq472nsgk7eeqwuk72titnba434rjx3ks565tcthpdjr5eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

rar b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49

(this sample)

  
Link
https://tria.ge/251006-xv663synv7/behavioral2
  
Delivery method
Distributed via web download

Comments