MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235
SHA3-384 hash:	92c484cacb2d2ddc6c89a1a70d6bc4da203990d7f7dd125a65eeba9bfa8fa3d08f6adad2904500e9b983c23719d663e3
SHA1 hash:	411f7b17fcb5352ee11e456d42b00c3bb895e54a
MD5 hash:	f90e1a8fac7c355b7545a922be728151
humanhash:	xray-missouri-zebra-utah
File name:	Setup.exe
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	437'248 bytes
First seen:	2026-09-12 13:56:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7392a57fcd5628dad81f224e88a7a3f2 (1 x ACRStealer)
ssdeep	6144:1ir8Ea9PTTQFYubm2Y2xTagrJLINV3OecssobPH:1iwEaBTMpS2lxegF++ehX
TLSH	T185946B13EA5460A8D05ED4BC8F2A9612A4F07C088FD0BAEF5BA16D411F79BD4BB7D704
TrID	45.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.2% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable (generic) (2000/1) 0.2% (.VXD) VXD Driver (29/21)
Magika	pebin
Reporter	aachum
Tags:	ACRStealer exe

iamaachum

https://sbroxe.sbs/ => https://www.mediafire.com/file/kcto9eep07az5if/SETUP_INSTALLER_(PASS=6315).zip/file

C2:
creativex5.cc
boss1huesos.cc

Intelligence

File Origin

# of uploads :

# of downloads :

162

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-12 14:03:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/af907ed8-dc46-4ea1-b541-8c146f0b97f3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/85170/

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug dropper

Link:

https://www.filescan.io/uploads/6aa55a488f5bfe2f84665729/reports/d4d52093-b935-4415-b0cd-7dbc248aaa32/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-09-12T08:55:00Z UTC

Last seen:

2026-09-12T23:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/233bf836-7c49-4539-a2d2-e6d6204f688d

Result

Threat name:

ACR Stealer

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1972252

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

Multi AV Scanner detection for submitted file

Suspicious access to claude desktop data directory by non-Claude process

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected ACR Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/f90e1a8fac7c355b7545a922be728151

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-12 13:57:39 UTC

File Type:

PE+ (Exe)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zpebqpwgzw7gwebfgopf6n62urqi2y6qjeuw3llhs4pcl7iy6i2q._file

Gathering data

Unpacked files

SH256 hash:

cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235

MD5 hash:

f90e1a8fac7c355b7545a922be728151

SHA1 hash:

411f7b17fcb5352ee11e456d42b00c3bb895e54a

Link:

https://www.unpac.me/results/efca67d1-3d87-4793-b117-17c30e1d6127/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cbc8183ec6cdbe6b1025339e5f37daa4608d63d049296dad67971e25fd18f235

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.