MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b2ff65464943d289c66fa22abc2285c166893e3a087a6c4eae3b521bce0aaaf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ACRStealer
Vendor detections: 3
| SHA256 hash: | b2ff65464943d289c66fa22abc2285c166893e3a087a6c4eae3b521bce0aaaf9 |
|---|---|
| SHA3-384 hash: | ba3d9eb3625ae211de967e71c3d0b591900a3bc47ec0d3eef660259d62542f2fe3275660132bf43f18eaac7ce937de68 |
| SHA1 hash: | a5fcfc306b282dd13a9aa0b2508e20e67b56547f |
| MD5 hash: | 7c816420c607b7a91d2cd31d0537b78f |
| humanhash: | enemy-xray-robin-football |
| File name: | Full_version_repack.zip |
| Download: | download sample |
| Signature | ACRStealer |
| File size: | 52'009'043 bytes |
| First seen: | 2025-11-04 15:01:19 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: 2025 |
| ssdeep | 1572864:LNFiNZQpqdpuT8YNbQtb55yPVHbfPkQQE5XnZ5TR/1nlk:LNFiNZQpqjKRQn5yPVHbP0qjI |
| TLSH | T1D9B73321EE1BBB7EC30D27BAD261946030D2E716882EDA214491927F04167EC7DDF6F6 |
| TrID | 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1) 33.3% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | zip |
| Reporter |  aachum |
| Tags: | 2265ca 46-62-175-223 ACRStealer Amadey file-pumped pw-2025 zip |
iamaachum
https://gamefiledo12.pages.dev/ACRStealer C2: 46.62.175.223
Amadey Botnet: 2265ca
Amadey C2: http://mi.huffproofs.com/kaWt2QXfpPueNM/index.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
140
Origin country :
ESFile Archive Information
This file is a password protected archive. The password is: 2025
This file archive contains 142 file(s), sorted by their relevance:
| File name: | getalias.phpt |
|---|---|
| File size: | 1'341 bytes |
| SHA256 hash: | 79ee22008362f32c67c005380a708fd7f7a214d0d987e401bffab23437723bdb |
| MD5 hash: | 14956301b76008f50b98639efca08072 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Setup.exe |
|---|---|
| File size: | 79'615 bytes |
| SHA256 hash: | c924dcf0b11acf90f268ce5baf415dc25f07a680ce7691afe07a0a2f996a8dc3 |
| MD5 hash: | b94ce9a4c4630bd89bc1755216eb3e9e |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug73333.phpt |
|---|---|
| File size: | 504 bytes |
| SHA256 hash: | af976b3d6d27174e48523225e63b68ebe1cea8ecca4538c1808d791743901d78 |
| MD5 hash: | e451bf025e7d0b6fc9ecb3db40d7dbb5 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | vet_internal.txt |
|---|---|
| File size: | 1'525 bytes |
| SHA256 hash: | 5f5523f3372b361aeb5b5ae6d1b7fe2f72deaf8954a0a1070257ff1c0a82fae9 |
| MD5 hash: | 69793826e12366cac11f50d66647a7ab |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | mod_string_alias.txt |
|---|---|
| File size: | 146 bytes |
| SHA256 hash: | 6b8a3dc1219355f7c151a9da6d3fc5be4bb4e27edf85de470c6a6f22d1255a80 |
| MD5 hash: | 0b50524b8d7739ab3704e68d24d79e81 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | NETCoreSdkRuntimeIdentifierChain.txt |
|---|---|
| File size: | 20 bytes |
| SHA256 hash: | c8376a7b24ab109ad59eb5e070c904959ea3c27121ed4662eee3cfcb8222000b |
| MD5 hash: | 8c42426dd89fb85da5b93365ec80bcc3 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | NuGet.Console.dll |
|---|---|
| File size: | 216'984 bytes |
| SHA256 hash: | 798dec805277e731117e74311b97641fdc9e6117e1bfbc686ff09dc9576ce117 |
| MD5 hash: | 85f601d08c54cfd537344b69cfedca35 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | ns_end_resets_seen_symbols_2.phpt |
|---|---|
| File size: | 721 bytes |
| SHA256 hash: | 226b8c47d98a3c03218313e24406066810d251bd59e7b449bd518d0684a98f6f |
| MD5 hash: | 0ce916739fa6347313a9441dcf9f4344 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | reconcile_reused_namespace.phpt |
|---|---|
| File size: | 1'067 bytes |
| SHA256 hash: | fa9d6ca8ce93efbac4aca247c17eaf0439040511ca8ac39512086ac01701ba0a |
| MD5 hash: | 79cb1f046853c73edc2123d328ec21a1 |
| MIME type: | text/html |
| Signature | ACRStealer |
| File name: | Microsoft.Build.Tasks.CodeAnalysis.dll |
|---|---|
| File size: | 256'264 bytes |
| SHA256 hash: | 458cd882687fa33df36ed423606c5422c903c39339d5ac708a82d2e3e2ac21c9 |
| MD5 hash: | 96cd53799793171f96bc702948a229f0 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | System.IO.Pipelines.dll |
|---|---|
| File size: | 203'032 bytes |
| SHA256 hash: | 1c84e28a57ed50ea4aa60863f162e89482ae50a6d7f5b8fe6ce1016c14718d2b |
| MD5 hash: | 1064a7f32322676fe83e7493646c81a0 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | throw_into_yield_from_array.phpt |
|---|---|
| File size: | 611 bytes |
| SHA256 hash: | 9ae2c7839b7650d27c02511b0775269a071100614fb461d6e88e25fe336f93a1 |
| MD5 hash: | ee1656ad2a911383f49cf3ba92dc9e80 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | bug60160.phpt |
|---|---|
| File size: | 522 bytes |
| SHA256 hash: | 7d549e35827a3384ca39df48ea85d73098060018087e206a36e5f2669d9d7b27 |
| MD5 hash: | 24ed557937be2ae379b4f4e32cf1b1f9 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | pdo_sqlite_open_basedir.phpt |
|---|---|
| File size: | 955 bytes |
| SHA256 hash: | 9dff5a68db5111e2004f408b765e86709e708fa99ff45ce14ac46954abaf39a2 |
| MD5 hash: | 3c97bcd67d08994102fe7506beded172 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | json_decode_exceptions.phpt |
|---|---|
| File size: | 884 bytes |
| SHA256 hash: | 6ec5035790075d9c2fc5ab14ea7c4df242a137d43daaea9b4ece596b04c5367c |
| MD5 hash: | ff423f56048c99160a97875545cbf253 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | pcgoneseq128xslrr64_seed.phpt |
|---|---|
| File size: | 1'567 bytes |
| SHA256 hash: | 7ada175d06856298362c3ef8204beb35c827cc66fc971c9e550779c42552098a |
| MD5 hash: | e610f8823ce4da44b119b28768251968 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | odbc_field_name_001.phpt |
|---|---|
| File size: | 931 bytes |
| SHA256 hash: | 3adfd12813988d6d3d8bdd734fc634d698cea8ff89aafce4ec2cffbe0b87a8c5 |
| MD5 hash: | bfee62f6c9aea89cc9cf4d94553bc080 |
| MIME type: | text/x-ruby |
| Signature | ACRStealer |
| File name: | msys-pcre2-8-0.dll |
|---|---|
| File size: | 635'056 bytes |
| SHA256 hash: | c7b8672a7008f5b06ca74b57ab1d986dde305f37d48fcb8efe2b9ef357068f61 |
| MD5 hash: | dc0012ae753d3ab013a5f92450d389f3 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | ExceptionHandler.dll |
|---|---|
| File size: | 131'584 bytes |
| SHA256 hash: | 6036be1c9a8819998ad10879dff6c04edc787d34a142a3e0841c0fca36fb9c6e |
| MD5 hash: | 7c76e3100bd67c47f176a0edde3ef79a |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug24499.phpt |
|---|---|
| File size: | 381 bytes |
| SHA256 hash: | ee8d73e63ad7b4d32fbe7d194d6101bef191a5861d86d670c88148ad5b62b979 |
| MD5 hash: | ee007f0617c7277d5bc2d7fc355d8d72 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | InkDiv.dll |
|---|---|
| File size: | 358'400 bytes |
| SHA256 hash: | fd6636fe33a757689eba4c8ad56a5b56fd4a972c24d907442d9e2a7559b99b88 |
| MD5 hash: | 8c5bf2b676e6777158cadc210474bc33 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | PresentationFramework.Luna.dll |
|---|---|
| File size: | 682'144 bytes |
| SHA256 hash: | 730208fdc3057f3a0645f85fb9655b5128584dffe5649045f660c4134bc68fbb |
| MD5 hash: | 50c35a63c245728e8f49a79ae95460d3 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | BugSplat.dll |
|---|---|
| File size: | 303'568 bytes |
| SHA256 hash: | 4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968 |
| MD5 hash: | 27d48c6c48d5259a4e2ad7be369ce906 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | gc_002.phpt |
|---|---|
| File size: | 265 bytes |
| SHA256 hash: | 634e356a4a8d6ab4873cb2675016abd0967d8f48a202248c2fd57782a0a2fb44 |
| MD5 hash: | 5ece096e46e9a0388d094eb7b7dfbd2c |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | file_get_contents_variation9.phpt |
|---|---|
| File size: | 2'363 bytes |
| SHA256 hash: | e72f0a4fb1bd71584f63454c9ef23259ed522db0ccac6b5a2714eb843d7f2a10 |
| MD5 hash: | 1e4149c757b782fedfe4d10532f4bac5 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | oss-fuzz-65498.phpt |
|---|---|
| File size: | 238 bytes |
| SHA256 hash: | 13296380782791fc918df365ec440d2e42effcb5fed2dfce05c1400b8f9aaeaa |
| MD5 hash: | f59e88c2cbf09129c651b0ccd919f377 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | mod_nomod.txt |
|---|---|
| File size: | 644 bytes |
| SHA256 hash: | 2bb5a6567006d3c0243bc999a85f4f00feb3754fc5673a092be94e472ac8d55a |
| MD5 hash: | cfe51440592ada7c565cb0dfd61551f9 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | Azure.Identity.dll |
|---|---|
| File size: | 312'208 bytes |
| SHA256 hash: | b3c7a521e3829de15bc8daf15c2cbf8e8cb5140f87f02834514d685b0a968956 |
| MD5 hash: | 8b92e9cbc7e04e95dd5801b6ff1ad081 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | AuraLayerManager.dll |
|---|---|
| File size: | 164'312 bytes |
| SHA256 hash: | 13d6be93ec376cb7eaa7d585ddea23b0b46ea36a2ec99791d7b3c88cd4269c61 |
| MD5 hash: | fd72d9653eb08492a8221392cbc3a457 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | libaccess_output_shout_plugin.dll |
|---|---|
| File size: | 466'560 bytes |
| SHA256 hash: | 9463a4262f19a996e08ccbc17a6c09b192b59ce0ed6b30a61f98a58ec11a35f7 |
| MD5 hash: | c68c065f157f8a8f8d929005a3d001fa |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | cover_runs.txt |
|---|---|
| File size: | 413 bytes |
| SHA256 hash: | 8baf6141c53680793d5d2148f1c9ccbaa8cc9f707353b7cff39edceb72c72055 |
| MD5 hash: | a028f466f417316413965a997a90bd07 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | scintilla.dll |
|---|---|
| File size: | 632'320 bytes |
| SHA256 hash: | 76bb9249bbfd9d053ec03d0cbae2f20656e0f75b7a882b12d141cbbcf9a98153 |
| MD5 hash: | e8baaff43abf29a45e9793f1b8298fc9 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | DBGHelp.dll |
|---|---|
| File size: | 992'208 bytes |
| SHA256 hash: | c1275ddf04a0942b416c1a0b2d32003a4eda732c6f97c74181c236e35d12420f |
| MD5 hash: | 3094481f0cb0531b407d2388ecb4b85f |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | array_push_variation2.phpt |
|---|---|
| File size: | 2'303 bytes |
| SHA256 hash: | b90b7b9c30bc30703051dfc2838e4a7f0c8738978b0ddc25a74ca8b3342fa4d3 |
| MD5 hash: | a25fd59ba40356d74a501212f12b2bd3 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | Microsoft.NET.Build.Tasks.dll |
|---|---|
| File size: | 1'116'424 bytes |
| SHA256 hash: | 996710ed9f0c7ba3719a1a965920d8f28f43b05e9649ef5751e6748d9d25f7ed |
| MD5 hash: | 2af5c29e8b284fe1d2e42659370fab37 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | System.Collections.Concurrent.dll |
|---|---|
| File size: | 264'368 bytes |
| SHA256 hash: | e6a4f9378d6bc552c95ae730cdc72540a859f324f57ab12d33bb91340be97460 |
| MD5 hash: | 7f4a788279433a80d56d83622d67aa2b |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | copyonwrite22.phar.phpt |
|---|---|
| File size: | 240 bytes |
| SHA256 hash: | 81b7ba98ec29720123c936889dd5f25cf949c53dc1d4277b66158a414bfc4c0a |
| MD5 hash: | 2361eb4b1fe4d141daeecef9e3d990e5 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | DateInterval_serialize-003.phpt |
|---|---|
| File size: | 1'870 bytes |
| SHA256 hash: | 12aeb29d17c47bb7ed2094283e5b50ccfafa29e2c7236e42893eb8097c121813 |
| MD5 hash: | ec27ab2bd79a21a4d862044f45279a23 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | r2_base_005s.phpt |
|---|---|
| File size: | 1'661 bytes |
| SHA256 hash: | 7833715828973e79f0dc795a6980cefc8da80f7c0e0a03e4e4c490d15eef9889 |
| MD5 hash: | 6607855e9af2a71c30b224d677d70891 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | gh10187.phpt |
|---|---|
| File size: | 161 bytes |
| SHA256 hash: | 6b9d779390592e3e6ab685eae7a51e305c3023061b6017658ad15241a030d776 |
| MD5 hash: | 25d99fd581e13f2e18257b56298c2808 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | XamlAnimatedGif.dll |
|---|---|
| File size: | 258'048 bytes |
| SHA256 hash: | 923196136b83757fa29026363c3439b80384a95e0cfad3c52657f0a5e8dcf5a8 |
| MD5 hash: | f50c5b613dc0d5e65a9cb1c1795a6a1c |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | DVDSetting.dll |
|---|---|
| File size: | 42'496 bytes |
| SHA256 hash: | 718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549 |
| MD5 hash: | 05c88530d48f20ec24dbc4df3470e57d |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | README_el_GR.txt |
|---|---|
| File size: | 2'458 bytes |
| SHA256 hash: | 41e26cc87cac54962d9e0d435e78265c68a6a8fe2ad41b00f25e38a547d367a9 |
| MD5 hash: | 3044fccf3ff98d81996eff736401cfac |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.DesignTools.XamlLanguageService.dll |
|---|---|
| File size: | 1'223'104 bytes |
| SHA256 hash: | 300da86b70c6cd9a17f398bd05502d2cae428a4b79b303404e2250b68615c4ee |
| MD5 hash: | d4addbe2a89c1eaff4aa6ac29894783c |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | BoxService.dll |
|---|---|
| File size: | 344'728 bytes |
| SHA256 hash: | 56a903cd854f65bb7d8f27498f147ef20842e6576012cffe50d49f005b913681 |
| MD5 hash: | 72f06aa78ca77ac2094d3e564a017d3e |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | preload_ind.inc |
|---|---|
| File size: | 59 bytes |
| SHA256 hash: | 178da1094cd2d01ef60495be4d81e79c5c4d9d52f33b4a39c1c1e1048b3360ca |
| MD5 hash: | 8e4c94c417fbef4fcc176b85bca3ecd6 |
| MIME type: | text/x-php |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.ConnectedServices.Package2.resources.dll |
|---|---|
| File size: | 230'336 bytes |
| SHA256 hash: | 3ac060587495a7fcf969ce9680c862c944c92076acea9a92eb86c3dd66c429a9 |
| MD5 hash: | cc2150494d327af57eba1b169a48ed65 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | GRINTL32.DLL |
|---|---|
| File size: | 208'256 bytes |
| SHA256 hash: | 1b7eacf041fce0ef4b48ea3aa8afe885fab0324c7de51e07144ab4d4ee82c36e |
| MD5 hash: | f7f83d6f4e29b27a42744560a16a37cf |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | AudioRenderer.dll |
|---|---|
| File size: | 817'864 bytes |
| SHA256 hash: | 63055ae72febd0b1a1fe9e9adc21e0201e1888b10da552690de14928374ab658 |
| MD5 hash: | 93ee9ae6c6d823afb04cbe08ef1a1392 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug72731.phpt |
|---|---|
| File size: | 300 bytes |
| SHA256 hash: | ee70d3dcb99278a9e65c6ff6c87a8e5c72adfea83d1eb3619b5284cc95988823 |
| MD5 hash: | 7ff1b2574d45317af24833f485b25a21 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | System.Data.SQLite.dll |
|---|---|
| File size: | 386'200 bytes |
| SHA256 hash: | a7dc4a86fe7b16f330d02683589e4bfc79306b5ff08ebf40a9a8135bc2767986 |
| MD5 hash: | ce5a918d9ce213b5e84815733455ae32 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | NppShell_06.dll |
|---|---|
| File size: | 233'024 bytes |
| SHA256 hash: | c678471fc86fa3d91a15072f58474271193e09ba150400431b549605a8ddcc7d |
| MD5 hash: | 1fd3bee83f987dc33c05251a7738db0b |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | libdtv_plugin.dll |
|---|---|
| File size: | 904'832 bytes |
| SHA256 hash: | 6851a0bc1a53d80f5007757c2421a0e317a8b0c79a6ef3dad8c078db9b6d6fb4 |
| MD5 hash: | a137f71c6dde9f60cfca58f280feead8 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | symsrv.dll |
|---|---|
| File size: | 415'672 bytes |
| SHA256 hash: | 3ba985197a1dedc2c63de0a2b272971edcb39bb6ee35e10c4fe36fc664caa26a |
| MD5 hash: | 3cc4ddd705333741363b1e81af777203 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | UIAutomationClient.dll |
|---|---|
| File size: | 415'920 bytes |
| SHA256 hash: | 4633011221cbc7e10db0ceee5c7e00f37b8025b82b4e331f53643fdc2005e012 |
| MD5 hash: | 196497c2438a60b02cae2b8437a1e7e9 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | mod_dot.txt |
|---|---|
| File size: | 4'722 bytes |
| SHA256 hash: | f6a2b296b50d1023a647bddf7b65f3b9023e2b30104526e9719e4471119e7d2f |
| MD5 hash: | e463c3e9e03cd311197f35a660e48149 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.AspNetCore.Mvc.Abstractions.dll |
|---|---|
| File size: | 268'552 bytes |
| SHA256 hash: | 9bb1201305a99fc6be9a2d90daed5b8b9e8db9c54a183eae9bccac14227a3ca1 |
| MD5 hash: | 7bc25b7b712fd3cccf6b2e9c696e3797 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug13213.jpg |
|---|---|
| File size: | 596 bytes |
| SHA256 hash: | 705174d1a2c11f8eb53206339f7c64421e94fb326b6201ad6bc54a8894866c73 |
| MD5 hash: | 0e6bad7195ecd72ce70e1fdcdd33cacf |
| MIME type: | image/jpeg |
| Signature | ACRStealer |
| File name: | test_race_install_cgo.txt |
|---|---|
| File size: | 1'844 bytes |
| SHA256 hash: | 1ce68948150b312bd41a2d218b3f86babd6246d15b03ed10c040e62343200d5b |
| MD5 hash: | 310d2d15737083249b866a76ed3aecde |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | phar_gzip.phpt |
|---|---|
| File size: | 1'013 bytes |
| SHA256 hash: | 0279c40a260347adf4158c62b3c88eafb704ea9c098a1173163e312387738ac5 |
| MD5 hash: | 311033937a7cf9e1ffac8d3e80f7ae0f |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | import_unix_tag.txt |
|---|---|
| File size: | 751 bytes |
| SHA256 hash: | f79f239fd99f29fc2b2bb891fc8b5f4172f09cc69204573e02ae5a50f5b39cca |
| MD5 hash: | a5e5db2e8ea2ca598feb45e90a958cae |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | Installer.exe |
|---|---|
| Pumped file | This file is pumped. MalwareBazaar has de-pumped it. |
| File size: | 677'777'890 bytes |
| SHA256 hash: | aa5168c20c885a7a7778246f9de51f279b04615b8feafba5bccc33cb9ffbf92f |
| MD5 hash: | d4063c30c4af689cfc39f4f0a36bbb1b |
| De-pumped file size: | 516'075'520 bytes (Vs. original size of 677'777'890 bytes) |
| De-pumped SHA256 hash: | fa369dd9bfd0e94986ff1718a91be075aee9479994580cbb3787330639ecbb89 |
| De-pumped MD5 hash: | d0cf41e4262634ed66dcab46b3823a50 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.Crm.Sdk.Proxy.dll |
|---|---|
| File size: | 384'856 bytes |
| SHA256 hash: | 874b9b05ba2b7c300bd06d96e52712f1a9fd37cd6672764942b716229c4d6af6 |
| MD5 hash: | 3ed1f4f19a11e8f01534796fc5256f0f |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.ProgramSynthesis.Transformation.Text.dll |
|---|---|
| File size: | 1'386'360 bytes |
| SHA256 hash: | 1ad6fe5fa3a024776878e3caa0930228a5322524fce17d5efc3f8ba34f742d4b |
| MD5 hash: | 856c41a58beae3d88d89ffde133d08bf |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.dll |
|---|---|
| File size: | 556'936 bytes |
| SHA256 hash: | a7ef749bc217369cccb2a43cb77faa45818747fc9b2c53c91ee6056990b2e4b3 |
| MD5 hash: | 597bdec2b9eb96188a10fc85a6b99c0d |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.TeamFoundation.VersionControl.resources.dll |
|---|---|
| File size: | 308'768 bytes |
| SHA256 hash: | b00692689159da2c3241dcedec4e26b92fa7fda301b2ac71f6e305f31cfb9ad4 |
| MD5 hash: | 1edafaab49cdaffedde6979e4d561a33 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | isodate.license.txt |
|---|---|
| File size: | 1'615 bytes |
| SHA256 hash: | d179933ed291e906b1e5ad84d5e49fed15adad84ef5a14644eab2fb1788bbd51 |
| MD5 hash: | d877f991bcf8a844128bc0763f38f809 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | DateTime_clone_basic4.phpt |
|---|---|
| File size: | 808 bytes |
| SHA256 hash: | 8878de3ee086a73d961f57a8ec40df7d220a413162b3df32e85930733f8b1feb |
| MD5 hash: | bc84de28fcffa36d62e58286d3c01c33 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.Azure.Management.PrivateDns.Fluent.dll |
|---|---|
| File size: | 271'744 bytes |
| SHA256 hash: | f30b0bd929e83cc5009060f8e11e2d85a0bc3da6d7e4a055ef7a7c96e3381c16 |
| MD5 hash: | 5fe3f4a36d695110d94b6b87ed5141b3 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | private_members.phpt |
|---|---|
| File size: | 1'664 bytes |
| SHA256 hash: | 12780c0542b07b2bd5273b4a4f59cdde41ab8e789d7de1b7e73e16cc2be62250 |
| MD5 hash: | 1e62d07026e2aee3d2e0fef50c7f2d8c |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | cpfecl.Android.arm.dll |
|---|---|
| File size: | 426'424 bytes |
| SHA256 hash: | f6c5835139ed53501fe0c07bc8b51666301adca683e9015377c5289f6e39ae96 |
| MD5 hash: | e55928d5ab0435f210d993c5b07f9d4b |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | font_element.h |
|---|---|
| File size: | 669 bytes |
| SHA256 hash: | 865bb13fc11e3396b217844093c6c4e22de07d57a9693d78327239b69c6f18a1 |
| MD5 hash: | 240864fb36a6a1bdc8547736af567d7c |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | bug80745.phpt |
|---|---|
| File size: | 772 bytes |
| SHA256 hash: | 0effdde3f24a3f4a783491d400dab566d0e042e0f3e1ea5329cf56187d60a420 |
| MD5 hash: | ed865f446db595b57f6d36c82da294d6 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.Interactive.Editor.dll |
|---|---|
| File size: | 316'464 bytes |
| SHA256 hash: | 21e83e13c1bedcd1e956080124311e723e79ba9425a628a4982ecbce9cdf4540 |
| MD5 hash: | 91d69e64472ca5deb07c7b657643c923 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | ogalegit.dll |
|---|---|
| File size: | 637'744 bytes |
| SHA256 hash: | 1618ea1b3aa65950fe82d1981ede0a9d0da9b74e94f80d730e4564c31ef69f83 |
| MD5 hash: | 56a3287be7cba153367c35f7567b879d |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.CppSvc.Internal.dll |
|---|---|
| File size: | 205'856 bytes |
| SHA256 hash: | a310a3c03fecfe4933e56ecf8bfbebecebad10898d7c9a784d41654f7f5944d4 |
| MD5 hash: | 862869d2c58ce32858142acbf5474973 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | PowerArgs.dll |
|---|---|
| File size: | 806'400 bytes |
| SHA256 hash: | 81361e92cb03787bcc0465eda8c5fbed6d9d5f7483b17cb13ce2e4699a6434e5 |
| MD5 hash: | 9831b7f78c0978e28d72aaf34398f99f |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.TestPlatform.Common.dll |
|---|---|
| File size: | 501'920 bytes |
| SHA256 hash: | f835b26ce32e850b98c40902d2cd7c25f89a895b4af90985d6f20cdc61402b05 |
| MD5 hash: | f86558319b0886a685747be60317467f |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Xamarin.Forms.Platform.WPF.dll |
|---|---|
| File size: | 477'408 bytes |
| SHA256 hash: | 597f94b5fee1e0fc955c8cfa90ff90efdf339a71e18f6ec882718a10a6498edd |
| MD5 hash: | bec9615acfed1d0be47bdf6b907180d4 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | property_override_private_private.phpt |
|---|---|
| File size: | 421 bytes |
| SHA256 hash: | 135ee22590096012abddb11ac12fdff890c304aaa6c7d38f3cfefa7b85ab8ad1 |
| MD5 hash: | 5c5b9a742277ce031feb2976e7bb8f42 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | msys-svn_wc-1-0.dll |
|---|---|
| File size: | 714'408 bytes |
| SHA256 hash: | b6848271106fed2a089edde872f079cc45c386a84f2bf3fd50f4e44fdf7d3326 |
| MD5 hash: | 261aa83984d9faa82e0af1782822f922 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | x86_64-w64-mingw32-agrep.exe |
|---|---|
| File size: | 36'022 bytes |
| SHA256 hash: | 436d6e9f1198a443c5512ec9ecec1b7d6b60261ab1d62271f7ee74528353604e |
| MD5 hash: | 309825299f0622a8e48d43760af89d65 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | fe_fetch_op2_live_range.phpt |
|---|---|
| File size: | 238 bytes |
| SHA256 hash: | 09ec16b09790f28897c9c7c554f3b71a6878d459e6649a7d8e4007005335c852 |
| MD5 hash: | 41a5b3c401424e772d37a0c16921219d |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | dtor_not_called_if_not_init.phpt |
|---|---|
| File size: | 742 bytes |
| SHA256 hash: | 7b0632cf1dac876402ab53c67e3d86e2ab6b373f8ffbd6df9da590932353a7d6 |
| MD5 hash: | c4dcbf669b435f3c4674480e8887d525 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | CppCoreCheck.dll |
|---|---|
| File size: | 1'067'440 bytes |
| SHA256 hash: | ef998eddb3706dd037f0d39203b633b9b9a4adb89ad8e3d2fd719771a0d79c80 |
| MD5 hash: | 2d17974166b15d0868f2d360f75b9058 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | closedir_basic.phpt |
|---|---|
| File size: | 1'075 bytes |
| SHA256 hash: | b3eb2bf2178c34e5003833b134c97d82401d5b3358b5c3f1cafd670d8ebc538a |
| MD5 hash: | 26935f9e4ccd4849ebf6c517342587e5 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | TaskbarSetting.dll |
|---|---|
| File size: | 270'024 bytes |
| SHA256 hash: | 0dd14e6708a0b47e114a12c7c261049adbf284672fd0b9e72d7b94c0e0e32ad9 |
| MD5 hash: | d0a2f6073a2200c540e98a855442820a |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug44144.phpt |
|---|---|
| File size: | 423 bytes |
| SHA256 hash: | 2c3d76daf55a617ead518eff662e867212035d08f55f8c98f692103596264bda |
| MD5 hash: | 0ee04bd2d04a80a401552bb75f6dd8e9 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | Microsoft.WebTools.Languages.Shared.VS.dll |
|---|---|
| File size: | 209'336 bytes |
| SHA256 hash: | cea1e6118eea9cfb75948977124dc073cd6900581a6b8a72433a8e3ef32625df |
| MD5 hash: | 78314c72a1fc86cb8b6dc3dd89adb4eb |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | rsc.io_quote_v0.0.0-20180709162918-a91498bed0a7.txt |
|---|---|
| File size: | 2'233 bytes |
| SHA256 hash: | eebcb86c56167c35f47682e3228f413558d6a19ec5af7c64c5bb2267e8911215 |
| MD5 hash: | 61418723fca7915c0c1592df910c415c |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | ug.txt |
|---|---|
| File size: | 11'386 bytes |
| SHA256 hash: | 9d0268d1eeb8dfdebbb8ea1033c2b99cd667a244c9859085be5d54c9e5ced369 |
| MD5 hash: | ef3e8d61d03e42a3b40d6f0b12535adb |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | gopath_install.txt |
|---|---|
| File size: | 1'627 bytes |
| SHA256 hash: | 61192e33018db388b9a3fb52e3e79a0dbca40edb08ab9d5eb9df52b38580bf75 |
| MD5 hash: | 3525e4e6cec030e02c8db17887095f29 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | OneDriveService.dll |
|---|---|
| File size: | 333'976 bytes |
| SHA256 hash: | e7d729030e05e5e58ccb8c594fa4d40414d61dfa5e941c8686b615662e4a3ece |
| MD5 hash: | bdaf1413a04c1c3f8f9b063802428921 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | msys-svn_ra_serf-1-0.dll |
|---|---|
| File size: | 191'751 bytes |
| SHA256 hash: | 77f778884deb3b3ebf90b7303300124495b30d8b9fb626aa4b76a138c38cf97d |
| MD5 hash: | b2e8c5623fc3aeb1d368cda160eb39fa |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | sni_server_cs.pem |
|---|---|
| File size: | 3'521 bytes |
| SHA256 hash: | 44b2807a51462f4cfa54b131fa78c0b7d3c4246030d2aa4d7f0191239af2a42b |
| MD5 hash: | 2a466556595e0d9d8c102e92110a4b9c |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | DisplayLanguageNames.en_BE_PREEURO.txt |
|---|---|
| File size: | 33'766 bytes |
| SHA256 hash: | 6b7884673a6381ef470660585cb406595d8d898f6ee6b5e92aa180bab92b521a |
| MD5 hash: | c6762a82d75c68a93d7f0c15cf1c23e3 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | msemp.dll |
|---|---|
| File size: | 447'520 bytes |
| SHA256 hash: | 97dab22e35e8347749611bd4c1027e08ef577f0865039594dbc5bf813b3de5db |
| MD5 hash: | 912e3cd38d6db718c14110299a4670dc |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | ReflectionMethod_hasPrototype_basic.phpt |
|---|---|
| File size: | 777 bytes |
| SHA256 hash: | 69a20143f3830d0c8366dbe2dce600f2ffba695be128a79f8c34e93cb838057a |
| MD5 hash: | 2446d1090533284db888e62181254ac8 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | parse_url_basic_007.phpt |
|---|---|
| File size: | 6'236 bytes |
| SHA256 hash: | b8bc6349a7c0e6397800ab8dc35696be2c5cd4d789e9df262521fbecfcac278a |
| MD5 hash: | a5140fb4ef539ce0a11c28d7cac8b4b1 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | trust.exe |
|---|---|
| File size: | 234'698 bytes |
| SHA256 hash: | 95a65f1203e444c80fde62f10d3b6f24ff7ca2ab14a253cbdbccce1e2ac58462 |
| MD5 hash: | f825cf140156703f5b0119dd32f13fe3 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Ceckflarrak.gag |
|---|---|
| File size: | 5'536'798 bytes |
| SHA256 hash: | 2a01096fa435f93eaec18bd9d6972fba7b21b9fbbb755d882d22f4033b7fe23d |
| MD5 hash: | 7449d35b254920852d660bfe7708b60a |
| MIME type: | application/octet-stream |
| Signature | ACRStealer |
| File name: | SYMBOL.TXT |
|---|---|
| File size: | 15'731 bytes |
| SHA256 hash: | 9c1b5818d187d44b7fb19d0e6be435ff12c0a0be2a6a03a1f8bf478f12dec557 |
| MD5 hash: | 1b6006569d886b513a1a8b0b51927033 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | DisplayLanguageNames.ar_LB.txt |
|---|---|
| File size: | 33'268 bytes |
| SHA256 hash: | 0e018c63407cda60b1f4c1a8ecf3b93349c0caa3952b50ab6cbd6777adce4495 |
| MD5 hash: | 5e594bf69810971fdf2e3d2063149048 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | zend_accelerator_debug.h |
|---|---|
| File size: | 1'878 bytes |
| SHA256 hash: | 2efd9f78b2cda47604199c2c3eadccf8016c7cbdee4b7d171758061183ef74a6 |
| MD5 hash: | ddb9efe5bd681ca3f4eb389b683b2e44 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | WzWXFll64.dll |
|---|---|
| File size: | 610'968 bytes |
| SHA256 hash: | afc3132d046895526c82e3c29d06e636f059927a9fb57c3bf1a6558ccb9cf1a0 |
| MD5 hash: | 2a3864fc92d04501f150356ff842a4d4 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | DisplayLanguageNames.hy_AM.txt |
|---|---|
| File size: | 29'108 bytes |
| SHA256 hash: | a8b83864f8b89d47aba205aced953c3d57722ecb93462948b79707020e520ff0 |
| MD5 hash: | 60cca6ade351f7275521d624e23e44e0 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | microsoft.visualstudio.graphics.dll |
|---|---|
| File size: | 680'856 bytes |
| SHA256 hash: | e30abd7d20980e6e5201a4ce5fb94f0492e0f31fc866627c7340c08b12ef2317 |
| MD5 hash: | 3722b171bcaaa0dd245b45de546ea6a6 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | GlobIterator_internal_null_pointer.phpt |
|---|---|
| File size: | 2'395 bytes |
| SHA256 hash: | 6310e7d6b7888dd34acc1fda43f0ead5fb4b7ae32ec4dfd34aa8c300c9f977a0 |
| MD5 hash: | 7108b76631e54952fc91649ef5326585 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | test_doctest4.txt |
|---|---|
| File size: | 331 bytes |
| SHA256 hash: | dc4cd077da8b17ab75fb50c8cf8df6e4b868e51557ab60dff3e2705c1434f0df |
| MD5 hash: | 5527c818b331b9b7e7a8b74fd8f7111a |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | example.com_retract_ambiguous_nested_v1.9.0-bad.txt |
|---|---|
| File size: | 178 bytes |
| SHA256 hash: | 2753abce1429b374351636fb13a8448256db3c2386030edcc3aa4ed0e262e708 |
| MD5 hash: | 7a80c973ab024e6d5d2156be439f53ea |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | System.Windows.Forms.resources.dll |
|---|---|
| File size: | 475'912 bytes |
| SHA256 hash: | ed19c003d983bdeed54cb59da2a43c7ec8a97450fba5a3979ddebc9fb3811498 |
| MD5 hash: | 83b94c9fd813e2aa4a3fc53bf97c2a36 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | testfp.txt |
|---|---|
| File size: | 8'085 bytes |
| SHA256 hash: | d8e2eed3dac3ae0b757d092ad1c3f5fc04e3428ab422971206549304a8e81ea9 |
| MD5 hash: | dc1ca447fa01cae0bb5de6427d6aa4ae |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | spoofchecker_class.h |
|---|---|
| File size: | 3'203 bytes |
| SHA256 hash: | f3a66af2c1fefe82a1dc4d4b4d0a57fd1df9b1a4bdfc95ad6b215236b9f6858f |
| MD5 hash: | 0b37b3ca1c9a369689e448397135c36e |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | qtquickcontrols2materialstyleplugin.dll |
|---|---|
| File size: | 746'480 bytes |
| SHA256 hash: | 2eabb8e5f3b57e42c6f29db645edc4bac17910b1ac0d8d0083c66b152f8878b8 |
| MD5 hash: | b7d862f5f15e86b73c670913684fa8e4 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | value_edge_cases.phpt |
|---|---|
| File size: | 389 bytes |
| SHA256 hash: | 027e0781cee245ce1c52a65cff44592230f1abfeeaa99d2bbbbac52c6fe82af0 |
| MD5 hash: | 9203d5774b8e10f8dc13b2154de73452 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | strspn_variation5.phpt |
|---|---|
| File size: | 2'423 bytes |
| SHA256 hash: | 47ea27a9d63c522693dd3e51ae0ca286b7f9a0c4949795267d269f8fbecb8f29 |
| MD5 hash: | 3439910669d0ea0c415ba355af590920 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.TestTools.TestSettings.dll |
|---|---|
| File size: | 645'568 bytes |
| SHA256 hash: | 0e2a0507e86eba585c3d25d03ee99a4a98b41633751dbfecd45cdc19c5111f07 |
| MD5 hash: | 6cad86e8f1a48fb928970dfbf4f6ed24 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.WebTools.Languages.Html.VS.dll |
|---|---|
| File size: | 341'944 bytes |
| SHA256 hash: | b225880f0aee5d11803d58b67866596376ad95922f1dc196ad880f9f5d68fe14 |
| MD5 hash: | 67239ab806e8d911da4bcc0182dcceaf |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | anb.c |
|---|---|
| File size: | 12'187 bytes |
| SHA256 hash: | bcb6067729bc8cf59e4392a79b9e0ab0b22e47d075af6f8e92e597452a912244 |
| MD5 hash: | fb14e8815725b967f20cce03405714b6 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | array_chunk_variation15.phpt |
|---|---|
| File size: | 1'544 bytes |
| SHA256 hash: | 9b528955c7c6056d182355a9def6b3b2f84452368582f5d30a80c160fd101817 |
| MD5 hash: | 0e7cf82a2e49d94a70bf4925b8fa1966 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | msys-ksba-8.dll |
|---|---|
| File size: | 243'180 bytes |
| SHA256 hash: | 76c5398f7e3cb7cbd19f9e1c691af0cf76bde44339630e02732face57bc74a3f |
| MD5 hash: | b4a5bbf2144f7c1b57587d2c15427159 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | phar_copy.phpt |
|---|---|
| File size: | 1'373 bytes |
| SHA256 hash: | 109fc2fc4218404c533529b64f738e07ae617f6965a544d65e407b6355c98d9c |
| MD5 hash: | 712107a695d46c464741724bf9544e06 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | usr_50.txt |
|---|---|
| File size: | 4'554 bytes |
| SHA256 hash: | 25d9107ed00aec5a4da19ce7f2e9dea852dd6291bf656cb3728fcf7c74b10166 |
| MD5 hash: | 0e03da6407bf85d16875ccdacd56d3e0 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | Microsoft.CodeAnalysis.Remote.Workspaces.dll |
|---|---|
| File size: | 449'808 bytes |
| SHA256 hash: | e634ca4353d4a951bc136286ea2deb8fc73e435c4dc606fc3c29801734c4d29f |
| MD5 hash: | 70a5e9c1e08e935771ffa077ec80a0e4 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | bug79467.phpt |
|---|---|
| File size: | 226 bytes |
| SHA256 hash: | 9714f73c64bf317ff7cf5222fc91f74776af44a650f2f4af8378bc4152f0ce6f |
| MD5 hash: | bd4c5d1cab51f63d61c7faf3cdad6fa4 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | WzWXFlc64.dll |
|---|---|
| File size: | 623'256 bytes |
| SHA256 hash: | 6f4fbaf934f43db4556500d82521d19db539e5c8ae5cb5bce812af145d8b3261 |
| MD5 hash: | 0240af87a82624fe412d7ffdd950a1f6 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | mozwer.dll |
|---|---|
| File size: | 330'304 bytes |
| SHA256 hash: | 99bcbc6dd04b0add980a1b272e5ffa4cf0b017e65a65a3653e727be36594257e |
| MD5 hash: | ed88025353ef136babc0b1030eddc0a4 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.Build.Engine.dll |
|---|---|
| File size: | 658'040 bytes |
| SHA256 hash: | a9dcb081cea11b01dbbbbb24b82781ff2394313c49410ba2a9d5f508446b52c3 |
| MD5 hash: | 7ddeea4b969afca6c75bdbcb9554f371 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | fopen_edgecases2.phpt |
|---|---|
| File size: | 1'194 bytes |
| SHA256 hash: | 6e7cac1d3e59a9436aa07e099f126653bbdc388e3e17e47747e6374ccf913466 |
| MD5 hash: | d5742b54831362acf312fac3add7c420 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | WzBGTool.resources.dll |
|---|---|
| File size: | 1'332'376 bytes |
| SHA256 hash: | 8d61d71474b47c1ea5eecc73d8f14424089ce7a3f167ee1823c6bb5070f1a19b |
| MD5 hash: | 4d4b4413aa99dff42a842a91fe6a8328 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | test_compile_binary.txt |
|---|---|
| File size: | 136 bytes |
| SHA256 hash: | ebfd40e35a3ecf802a194ff2ee5d08943c7552c7bcf09a4b5af5fda29d4f5230 |
| MD5 hash: | b222151f2a921994a7f55ed249f24f7e |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | LICENSE |
|---|---|
| File size: | 3'204 bytes |
| SHA256 hash: | b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a |
| MD5 hash: | fd469cce1a919f0cc95bab7afb28d19d |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | AdobeXMP.dll |
|---|---|
| File size: | 980'168 bytes |
| SHA256 hash: | f6e584a509a991c3eb11a8d49b705def6bd43761a4b603a2b3b3703fad179a30 |
| MD5 hash: | e4599a47906608651c920f535fccb359 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | Microsoft.VisualStudio.VisualC.Utilities.dll |
|---|---|
| File size: | 218'144 bytes |
| SHA256 hash: | 98af01cb023c78deaf2e4acdaf54371d05860f4d15fd8b4199e37fdbda602db3 |
| MD5 hash: | 35bef154e0c3526bde8ca3622e8c3044 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | cover_cgo_xtest.txt |
|---|---|
| File size: | 464 bytes |
| SHA256 hash: | bed5431394eb6c5333653c20a32906b2e715819a4cd9bdf654a472274aea2a9c |
| MD5 hash: | 0a56b02ce716e23097e7df11ef0b8183 |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | ChromeSetup.exe |
|---|---|
| File size: | 10'869'176 bytes |
| SHA256 hash: | 7a9416a603cbb0de9991f9c408bd6b31a29ef555e220a7d0408092e8e5349243 |
| MD5 hash: | fb255bdad5235134276fe22e08a51fef |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | ProtectionManagement.dll |
|---|---|
| File size: | 568'832 bytes |
| SHA256 hash: | d3af723624d6e8dc7356931ff94464909128345aafee8a127c1196659aa8bf61 |
| MD5 hash: | 5f15eb30501117ea79813aabc13e548f |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | list_replace_absolute_windows.txt |
|---|---|
| File size: | 693 bytes |
| SHA256 hash: | 3e1fc3419ab2e4e278080f52495a13c198a53bd350c60e452661ebc24fd7d298 |
| MD5 hash: | f31b2404b1879f7fb63e301914f7c5c6 |
| MIME type: | text/x-c |
| Signature | ACRStealer |
| File name: | import_of_namepace_conflicting_attributes.phpt |
|---|---|
| File size: | 1'770 bytes |
| SHA256 hash: | 507604c4edb443d922d4eedb93e23dc47b55be7830398b6785d3d2a7336706d9 |
| MD5 hash: | 50719091b0e8c38fc34490373de8debc |
| MIME type: | text/plain |
| Signature | ACRStealer |
| File name: | bug43450.phpt |
|---|---|
| File size: | 481 bytes |
| SHA256 hash: | e4accf4439ce5a9513ca5f1600298d2ba50572eaf44fa6e8bf769023d23035f0 |
| MD5 hash: | fbab3ba30708080adadf3e92c97d9ab6 |
| MIME type: | text/x-c++ |
| Signature | ACRStealer |
| File name: | COMSupport.dll |
|---|---|
| File size: | 60'928 bytes |
| SHA256 hash: | b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191 |
| MD5 hash: | 976ef4af05e92e4dbb612756e6798a37 |
| MIME type: | application/x-dosexec |
| Signature | ACRStealer |
| File name: | driver_booster_setup.exe |
|---|---|
| File size: | 33'239'080 bytes |
| SHA256 hash: | 65c5b929d9490779e8b88d92aa13634ca53a9ae67a6a98f7f1e69190ee92867b |
| MD5 hash: | fe7361b4406b2a2833737ae7cb715b06 |
| MIME type: | application/x-dosexec |
| Signature | Adware.IObit |
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Verdict:
Unknown
File Type:
zip
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
hijackloader
Score:
10/10
Tags:
family:acrstealer family:hijackloader discovery execution spyware stealer
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Malware Config
Dropper Extraction:
http://87.120.219.26/CCZT7wMNnD29ie
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AlternativesExample1 |
|---|
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | PK_PUMP_AND_DUMP |
|---|---|
| Author: | Will Metcalf @node5 |
| Description: | Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Adware.IObit
zip b2ff65464943d289c66fa22abc2285c166893e3a087a6c4eae3b521bce0aaaf9
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.