MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 38 File information Comments

SHA256 hash:	b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b
SHA3-384 hash:	e17bbc76030c7467dbc0f7cf50451a3467245ae8243ffe6c79eb6c635d52ce2f33d6808427514769c469c63140b7eee9
SHA1 hash:	1a0280ddb611c1877759cf09cf8f2f6521675994
MD5 hash:	836b2161586a787afbe154d63398b798
humanhash:	delta-lion-river-april
File name:	SETUP.zip
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	7'329'239 bytes
First seen:	2025-08-22 16:08:40 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:PP96jMMjbVq/Av8x6XI3WG9e7NdO3NC7LhF6HHKA:PV6I0fv8x6XI3WrBqWL6HHj
TLSH	T107763399C0C2172B6685D391CAD68773BAE351C041ACFEA53C77F1E228986445DFCF2A
Magika	zip
Reporter	aachum
Tags:	87-120-219-153 ACRStealer HIjackLoader IDATLoader zip

iamaachum

https://ieafinn.cfd/?L8P0DY9-utm=19W7N3 => https://mega.nz/file/zJ9XmRID#KDFWyDVcFl6zAE_K0YHTBQXn4qMnhm5ks2qXJcy8Ops

ACRStealer C2: 87.120.219.153

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:	Setup.exe
File size:	7'269'000 bytes
SHA256 hash:	dff65240079405e66088a1c453552b2ff1ba41cbc6c1976bcbc5b7b4caaef7f5
MD5 hash:	70a92c7f9c49b5d5e48d4b42891625f2
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	NvStWiz.prx
File size:	442'680 bytes
SHA256 hash:	c2ad5bd189df04b39be18dec5cd251cf79b066010706ad26d99df7e49fd07762
MD5 hash:	9e82e3b658393bed3f7e4f090df1fbe7
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	tradingnetworkingsockets.dll
File size:	4'249'928 bytes
SHA256 hash:	fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
MD5 hash:	3cf26ce759c5e261fe3ecc6451b8b08e
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Braim.zqf
File size:	1'943'446 bytes
SHA256 hash:	21391f0a0a14b64c4bb1e5cefdac81cfa4a4e8d034e56b647019b33ab184a06b
MD5 hash:	54e42a30d2cfa27441d7e066213c922c
MIME type:	application/octet-stream
Signature	ACRStealer

File name:	MMHelper.dll
File size:	61'064 bytes
SHA256 hash:	7f8b4d21bbe618b6d888b05acc6bcd86e9bb669600fdf6a3e56246aa3e310065
MD5 hash:	58220b3a16ab5c551ef6a618eff89954
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	trading_api64.dll
File size:	289'568 bytes
SHA256 hash:	f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
MD5 hash:	2bca4e2c047ec969cb3cff277e7fc184
MIME type:	application/x-dosexec
Signature	ACRStealer

File name:	Zoutthirtnae.ssfh
File size:	10'956 bytes
SHA256 hash:	27c15a54c5fb646eb31a2c10bc4912d21b7e89fa050bd5946756968a83335ef4
MD5 hash:	017074740a4abdcf4773244d53d97965
MIME type:	application/octet-stream
Signature	ACRStealer

File name:	ks_tyres.ini
File size:	10'077 bytes
SHA256 hash:	894d3c57598ecb22c769cc3ea8219859a95e22740e72394a474012ea2119b3d9
MD5 hash:	47f6571c7884da6c743551ac724186d4
MIME type:	text/plain
Signature	ACRStealer

File name:	sqlite3MM.dll
File size:	959'624 bytes
SHA256 hash:	cb7d27e2cf32db548bb0fa43c0bb238969d9439aa2c806c7bbba63c7d9084de7
MD5 hash:	5ce4d0b4fd72811e06e08c8db8eb47bc
MIME type:	application/x-dosexec
Signature	ACRStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a89648e9d9dbcfd96d1d55

Tags:

injection obfusc micro

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-debug expired-cert keylogger microsoft_visual_cc signed

Link:

https://www.filescan.io/uploads/68a8967028a89d9dd4f250c8/reports/522f294a-28dd-49b1-b1d2-3065ee35d56f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b/results?tab=lookup

Score:

22%

Verdict:

Benign

File Type:

Result

Malware family:

shark_stealer

Score:

10/10

Tags:

family:hijackloader family:shark_stealer discovery loader spyware stealer

Link:

https://tria.ge/reports/250822-t8h5maxjz5/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b4d6ceb70c01674360b3a56e7e1ebdbf96ab08aedd5db2108fb28bb5f710d83b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_DustSquad_PE_Nov19_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detection Rule for APT DustSquad campaign Nov19
Reference:	https://twitter.com/Rmy_Reserve/status/1197448735422238721

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Check_Dlls Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang Create hunting rule

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_KB_CERT_62e745e92165213c971f5c490aea12a5 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxProductID Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox product IDs

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/