🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423
SHA3-384 hash: 255ebab2a4e5a01be83ff794432d7367ee442424d3150306309b13633c698262ee064b16d9b59aa54a57eb0742b4e8f0
SHA1 hash: defcbc196f5649170a436830cf054c985ca9bbf2
MD5 hash: 7271cbbabea6764f68a8f2141bac0825
humanhash: orange-wisconsin-cardinal-jupiter
File name:BugSplat64.dll
Download: download sample
Signature ACRStealer
Create hunting rule
File size:3'449'384 bytes
First seen:2025-09-25 16:57:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dd802a80dc2c7b2e64ece3a5cb75be15 (3 x ACRStealer)
ssdeep 49152:M3U6mD80fnarnUxBOaHou5Y4U0a+tm2+IUwKQ4cZ3sc+BV58g9rSNU982tP:DDQLUv9HxOIUvIYX8uSi982J
TLSH T17EF5F19636D102BAC4ABC374C6462A6EF1377A424F708ECF1BD596512F33790C8BA725
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:6598d3 91-99-89-71 ACRStealer Amadey dll HIjackLoader IDATLoader


Avatar
iamaachum
https://enliscotie.cfd/?pub_id=12&key=10L4NwJFYBqxvlTRgSAkOtXQsWro7yeMC9Pjmh8U&site_id=22&data=9U1pyTzcD7isMZCVRBw => https://mega.nz/file/uHxVAbKB#ddrlwyYi0ljYs9yGIP3ulpf_tbu831eGh7_8U41x5lE

ACRStealer C2: 91.99.89.71
Amadey Botnet: 6598d3
Amadey C2: http://mi.snowfieldupriver.com/kaWt2QXfpPueNM/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
BugSplat64.dll
Verdict:
No threats detected
Analysis date:
2025-09-25 17:00:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/18f9140b-17ae-4d62-8891-8d7a7c9b5879

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29062/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d5745bcc9425144151ec85
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm invalid-signature masquerade obfuscated obfuscated packed packed packer_detected signed threat vmprotect
Link:
https://www.filescan.io/uploads/68d574bd74e5a28989935219/reports/eca0a4ec-b329-4a3f-9170-30fa4b8e8444/overview
Verdict:
Malicious
Labled as:
Win64/Packed.VMProtect
Link:
https://www.hybrid-analysis.com/sample/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423
Verdict:
Clean
File Type:
dll x64
Link:
https://opentip.kaspersky.com/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ae59cf5c-c87c-46f8-a802-e5835b3764cc
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1784310
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 1784310 Sample: BugSplat64.dll.exe Startdate: 25/09/2025 Architecture: WINDOWS Score: 48 7 loaddll64.exe 1 2->7         started        signatures3 32 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->32 34 Found direct / indirect Syscall (likely to bypass EDR) 7->34 10 cmd.exe 1 7->10         started        12 rundll32.exe 7->12         started        15 rundll32.exe 7->15         started        17 2 other processes 7->17 process4 signatures5 19 rundll32.exe 10->19         started        36 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->36 22 WerFault.exe 16 12->22         started        24 WerFault.exe 16 15->24         started        26 WerFault.exe 16 17->26         started        process6 signatures7 30 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 19->30 28 WerFault.exe 20 16 19->28         started        process8
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/7271cbbabea6764f68a8f2141bac0825
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-25 16:59:42 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lm7aqlr6xcg7gryitltr34bt7p47nb4w7gkq22dunepxcmtaqrq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/250925-vgwgbadk6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ec086fed-56d5-4b82-8d68-6041699bf4fb
Unpacked files
SH256 hash:
e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423
MD5 hash:
7271cbbabea6764f68a8f2141bac0825
SHA1 hash:
defcbc196f5649170a436830cf054c985ca9bbf2
Link:
https://www.unpac.me/results/527c29ee-217d-4e8e-9617-6ba4b5299c2f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip 3b1e25b0073a080b5a494b67147e760ce9d74ea7570ec62e5c32afa243809c39

ACRStealer

Executable exe e2d9f04171f5c46f9a3844d738ef819fdfcfb43cb7cca86b43a348fb89930423

(this sample)

  
Link
https://tria.ge/250925-ts8qcasshs/behavioral2
  
Dropped by
SHA256 3b1e25b0073a080b5a494b67147e760ce9d74ea7570ec62e5c32afa243809c39
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29062/
  
Dropped by
MD5 69239fd0c0d05ac78665de8687f9439e

Comments