MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739
SHA3-384 hash: 55e2f50b72bf2f2615b4b6943d7515c74c979dddeb126f080181769717ee167c2b08d3dc716223b366e2202ef46a3652
SHA1 hash: 72ad987d04733238978c5b6eb9bf704f628969be
MD5 hash: d45dc255d9d01adb6756c104e989d6d9
humanhash: social-alpha-fish-romeo
File name:file
Download: download sample
Signature ACRStealer
Create hunting rule
File size:2'008'576 bytes
First seen:2026-09-01 01:33:35 UTC
Last seen:2026-09-01 07:24:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (103 x LummaStealer, 85 x RedLineStealer, 62 x Rhadamanthys)
ssdeep 49152:yZ2AwyOX+f0ViW2STOdD8n0ywQEiaCQn7HDzunKo:bE0+TglKiaCQnTen
TLSH T1AD95231167F4C0BAD4E74F7189F40613F331BDD11B3097CF2AA5A98A1B22F98A63535A
TrID 43.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.0% (.EXE) Win64 Executable (generic) (6522/11/2)
7.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 9389a6a1b092d272 (1 x ACRStealer)
Reporter Bitsight
Tags:ACRStealer D dropped-by-gcleaner EU0.file exe


Avatar
Bitsight
url: http://91.92.242.236/service

Intelligence

File Origin
# of uploads :
3
# of downloads :
172
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Archives AutoIt
Details
Link:
https://research.acce.ciphertechsolutions.com/results/38d2eefa-aa81-4959-be75-1151f6aa2ca5/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-01 01:43:41 UTC
Tags:
autoit generic stealer auto-startup rat loader
Link:
https://app.any.run/tasks/eb147e36-6b65-4467-acc2-ce6daef56ffa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83492/
Detection(s):
SecuriteInfo.com.Trojan.Agent.17860.18982.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Deleting a recently created file
Creating a file in the %temp% subdirectories
Launching the process to create tasks for the scheduler
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug at autoit CAB expired-cert explorer fingerprint installer installer installer-heuristic keylogger lolbin microsoft_visual_cc packed reconnaissance rundll32 runonce sfx
Link:
https://www.filescan.io/uploads/6a962b952d417b07d19b952b/reports/14c1aa64-2631-4fc2-b0d3-cd7d015d3e77/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/517da597-3df6-4eb4-8850-113125019a89
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739
Verdict:
Malware
YARA:
6 match(es)
Tags:
AutoIt CAB:COMPRESSION:LZX Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 64 Exe x64
Link:
https://app.malva.re/file/d45dc255d9d01adb6756c104e989d6d9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzdnfgd7b4fay5aw5nhwyxw7f572ucelxrlyo7ger2fempkjo44q._file
Verdict:
malicious
Label(s):
Amatera
Create hunting rule
Link:
https://reports.threatray.com/dddc75bd-efa6-4691-a48f-d040d14c48df
Result
Malware family:
acrstealer
Create hunting rule
Score:
  10/10
Tags:
family:acrstealer discovery persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/260901-bza4jsvsc1/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Creates a file in the Startup directory
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Detects ACRStealer V4.x
Family: ACR stealer,GrMsk
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
proxy.nodefrontier.cc
Unpacked files
SH256 hash:
b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739
MD5 hash:
d45dc255d9d01adb6756c104e989d6d9
SHA1 hash:
72ad987d04733238978c5b6eb9bf704f628969be
Link:
https://www.unpac.me/results/3b1ea480-0ff0-48d7-b0f9-fe92f560a338/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

Executable exe b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/83492/

Comments