MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3b24d64c4156c1b9b6f1803c70689303502848f692d34b75a765008ecc4ff61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 16 File information Comments

SHA256 hash:	f3b24d64c4156c1b9b6f1803c70689303502848f692d34b75a765008ecc4ff61
SHA3-384 hash:	552c6ffa9477483e77190b58f96b6b9b112b5c90dd8f12aabc5a25f702d5b8b31682b000338e8545cd328e1dc81dddca
SHA1 hash:	16d87555495565937acff76cb05af4fbbe461f03
MD5 hash:	f120e9cc9131203b04bc54256215d94b
humanhash:	solar-nebraska-xray-seven
File name:	𝗗𝗢𝗪@𝗡𝗟𝗢𝗔𝗗$_𝗖𝗢𝗠𝗣𝗟𝗘𝗧𝗘❏⤖𝗦𝗘𝗧𝗨𝗣✷𝗖𝗢52𝗗𝗘#$$8466.7z
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	1'889'586 bytes
First seen:	2025-05-22 13:52:34 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 8466
ssdeep	49152:KVFMEHgdWw+2Wx67i7tZz9ssqutbPyMA4X:KVFFHt1ZpssqutbV
TLSH	T14D9533AC6B3CFA53AF266C283AF150C0BCD5606DC5EC9E75A8A757C7D0122412C76B1B
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z ACRStealer file-pumped pw-8466

iamaachum

https://hjdmcoq.com/?=ijn&diu=1052&sid=Naj => https://www.mediafire.com/file/1u7c82vzg8ejw7k/%F0%9D%97%97%F0%9D%97%A2%F0%9D%97%AA@%F0%9D%97%A1%F0%9D%97%9F%F0%9D%97%A2%F0%9D%97%94%F0%9D%97%97$_%F0%9D%97%96%F0%9D%97%A2%F0%9D%97%A0%F0%9D%97%A3%F0%9D%97%9F%F0%9D%97%98%F0%9D%97%A7%F0%9D%97%98%E2%9D%8F%E2%A4%96%F0%9D%97%A6%F0%9D%97%98%F0%9D%97%A7%F0%9D%97%A8%F0%9D%97%A3%E2%9C%B7%F0%9D%97%96%F0%9D%97%A252%F0%9D%97%97%F0%9D%97%98#$$__8466.tar/file

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 8466

This file archive contains 1 file(s), sorted by their relevance:

File name:	Setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	752'083'559 bytes
SHA256 hash:	da248a236454ed3480a574511f65f28d9ba550ecb999a46aeace3f7da8c8aeb1
MD5 hash:	c1c44f0cf7d379e13239e5889eb56a16
De-pumped file size:	1'192'960 bytes (Vs. original size of 752'083'559 bytes)
De-pumped SHA256 hash:	7fe18023cee945e2b06baa848e6c9fe29763e77d5f1147c0982135ab41bd38b4
De-pumped MD5 hash:	d4be6072d2c4c8fa9ddf7a281fa411a1
MIME type:	application/x-dosexec
Signature	ACRStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682f2d67c28c67d666446b11

Tags:

spawn hype sage

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f3b24d64c4156c1b9b6f1803c70689303502848f692d34b75a765008ecc4ff61/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2025-05-22 13:53:27 UTC

File Type:

Binary (Archive)

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6oze2zgecvwbxg3pdab4obujga2qfbepnewtjn22oziar3ge75qq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250522-q92ftavmy9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)