🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ACRStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71
SHA3-384 hash: 545c5bc396f2e0337a880600fc87f623f3c3a667401e4f47c0e95a553e4b06b67f9e66aa3dce863b983761e1e114904f
SHA1 hash: 6046bbbe1eadb386f88affa4cd14c72d8488da14
MD5 hash: 125e071f31818173ce91415ae2646e6e
humanhash: iowa-lake-ten-cardinal
File name:Zxl.dll
Download: download sample
Signature ACRStealer
Create hunting rule
File size:9'591'368 bytes
First seen:2025-09-25 16:52:15 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 90ad2364f9a8390548bd0f3054022715 (4 x Rhadamanthys, 1 x ACRStealer)
ssdeep 98304:DHZUK424G4roVRnzPqhGyV8gw240jAlUcu2rDOYFpTPaeW4t8P5EYF85b/yPSZH:sVknzPqhGy424KT2rDOY3Pjt45E/Xh
TLSH T15CA68D40F7C381F1D9CA01B0656BB77F9535770847289AE3E3942ED9A9312D23A7B28D
TrID 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.6% (.EXE) Win64 Executable (generic) (10522/11/4)
11.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4504/4/1)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter aachum
Tags:5-223-63-41 6598d3 ACRStealer Amadey dll HIjackLoader IDATLoader


Avatar
iamaachum
https://softsdownload.pro/?code=VrG98zJ6Dvo5IlQMmqh&uid=18&sid=7 => https://mega.nz/file/ORsUEBqQ#jRt23_ObryNQdZLa9SePmpGfZZijcisnPbywvEtSh-k

ACRStealer C2: 5.223.63.41
Amadey Botnet: 6598d3
Amadey C2: http://mi.snowfieldupriver.com/kaWt2QXfpPueNM/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
ES ES
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29061/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d57310cc9425144151ebb0
Tags:
injection tatus sage
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 crypto expand expired-cert fingerprint invalid-signature keylogger lolbin microsoft_visual_cc rundll32 signed
Link:
https://www.filescan.io/uploads/68d57362674d5fd6aa0ca98b/reports/edb6b41d-5095-4492-a3d5-0e5830830932/overview
Verdict:
Suspicious
Labled as:
Trojan.Khalesi
Link:
https://www.hybrid-analysis.com/sample/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71
Verdict:
Clean
File Type:
dll x32
First seen:
2025-09-25T10:25:00Z UTC
Last seen:
2025-09-25T10:25:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a8d474ad-3156-44a9-9191-77c73e2edbdb
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
4 / 100
Link:
https://www.joesandbox.com/analysis/1784305
Behaviour
Behavior Graph:
n/a
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/125e071f31818173ce91415ae2646e6e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=572yif7uarpecjl6t6te2ljuimo4qdq5f5an3lskmhmvu5nxhnyq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250925-vdlspsswft/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71
MD5 hash:
125e071f31818173ce91415ae2646e6e
SHA1 hash:
6046bbbe1eadb386f88affa4cd14c72d8488da14
Link:
https://www.unpac.me/results/5ab26a97-f23c-4182-ae4d-5a86ca3b98f7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agent_BTZ
Create hunting rule
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:ComRAT
Create hunting rule
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ACRStealer

zip b40d19f767146f02df2d60a01a5c573fa73a5737804675bdd64c9d2050d2a245

ACRStealer

DLL dll eff58417f4045e41257e9fa64d2d34431dc80e1d2f40ddae4a61d95a75b73b71

(this sample)

  
Link
https://tria.ge/250925-tszsfassgy/behavioral3
  
Dropped by
SHA256 b40d19f767146f02df2d60a01a5c573fa73a5737804675bdd64c9d2050d2a245
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29061/
  
Dropped by
MD5 3010db7febc74973065f622b6b5583b4

Comments