MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
SHA3-384 hash: 91820e318473083a4605932d73ab041ca008cf60d6ef7d499ad066b9098ee6d85fc43609188a2e81892e46209114b4f1
SHA1 hash: 78b4c59252b4d47a2c77d258c9c0c64518cb1c82
MD5 hash: 4bc62079f9a3f52085071e31a371e38e
humanhash: virginia-paris-eighteen-johnny
File name:sunwukongs.exe
Download: download sample
Signature ACRStealer
Create hunting rule
File size:3'225'600 bytes
First seen:2026-07-04 15:25:21 UTC
Last seen:2026-07-04 15:52:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3ba423c9731ea28467c939b948c7c213 (1 x ACRStealer)
ssdeep 49152:pEEUGD4SUc35nDx1qbhMyMMUEZzhLTgyyZ0NPUAkY8i:pEEUspD9nqbhgEN+Z0NPZkY8i
Threatray 3 similar samples on MalwareBazaar
TLSH T136E54911D3829869E1F32831852E912D116D7E33172850C7BEC2B9295E70EE76EB5E3F
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c2ba3b332b2fba84 (1 x ACRStealer)
Reporter aachum
Tags:ACRStealer dropped-by-OffLoader exe stream-flavorroute-cc SunWukong


Avatar
iamaachum
https://plasteredplayn.com/sunwukongs.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
sunwukongs.exe
Verdict:
Malicious activity
Analysis date:
2026-06-26 12:12:45 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/b90150d3-a329-4226-8105-96488d6d0ed4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72872/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop38.50846.14756.26312.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3e6cbb86bc95245bf9a448
Tags:
phishing smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Adding an access-denied ACE
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-24T18:09:00Z UTC
Last seen:
2026-07-05T19:30:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4c2ce4ce-3258-45c3-954c-8dd366720dee
Result
Threat name:
ACR Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1937471
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Yara detected ACR Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
12%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450/
Verdict:
Malicious
Threat:
Trojan.Win32.Shelma
Link:
https://tip.neiki.dev/file/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
Threat name:
Win32.Infostealer.Babar
Create hunting rule
Status:
Malicious
First seen:
2026-06-25 12:14:00 UTC
File Type:
PE (Exe)
Extracted files:
158
AV detection:
19 of 36 (52.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fzkpvalsc3a2fjmlhhkw52lsvuk3ehye4c74toa5wjpts3c2ria._file
Verdict:
malicious
Label(s):
unc_loader_053
Create hunting rule
Similar samples:
5b602304faf88737a24a3ad74f92938ea60eed8bdc4532131a31bce5a58be98a
ACRStealer
b5c7fbd5e805b6f1a9796c041be4f9829d2157e5b59a6608871511d045b8d79c
ACRStealer
d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
ACRStealer
error
ACRStealer
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/260704-svd33sg18y/
Behaviour
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
MD5 hash:
4bc62079f9a3f52085071e31a371e38e
SHA1 hash:
78b4c59252b4d47a2c77d258c9c0c64518cb1c82
Link:
https://www.unpac.me/results/9ab10f8f-a6d5-41e9-b256-e5b4905d3834/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_APT_EquationGroup_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

Executable exe d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3835260/
Cape
Cape
https://www.capesandbox.com/analysis/72872/

Comments