shellcode-dropped-by-acrstealer-[tria[.]ge-26-09-2026][.]zip

Resubmissions

25/09/2026, 23:48

260925-3twxlsad283

25/09/2026, 23:39

260925-3nljpazajb3

Sharing

Copy URL Twitter E-mail

General

Target
shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026].zip
Size 3.2MB
Sample260925-3twxlsad28
SHA256 11e520000a52655e9f4d9e7dbcbe5daf3a245164b3dc8a1cae30ade3706f86a0
MD5 b1b1f785f65169b8cfa8d2232bd9c3eb
SHA1 7c741cf9dfee2780a5bb024c733caaecd0583764
SHA512 25d1dc96926e3513e4ce9551f12b12d0c81aaac56ecdb14eea7b81051cd2a829bacb5d3c1c3e839d001b32dcfcb73b9c5b83cce072006ca3333d0414c57947ae
SSDEEP 98304:QY+LK3fO4FJPbZYT/UWzWCNaKp38VRqk9gvhrN:XP3FJCjxJkE0dOh5
TLSH
T129F5337FEAA4C1196302C263179C96F7BB09D6256E7F0271B702822DE54C3A7BDE4493
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/loader.exe

File Explorer

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026].zip

.zip 3.2MB
shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/78d4-1-1f7237

3.2MB
shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/README_ANALYSIS.txt

3KB
shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/loader.exe

.exe 63KB
shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/run.bat

42B

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026].zip

SHA256 11e520000a52655e9f4d9e7dbcbe5daf3a245164b3dc8a1cae30ade3706f86a0
MD5 b1b1f785f65169b8cfa8d2232bd9c3eb
SHA1 7c741cf9dfee2780a5bb024c733caaecd0583764
SHA512 25d1dc96926e3513e4ce9551f12b12d0c81aaac56ecdb14eea7b81051cd2a829bacb5d3c1c3e839d001b32dcfcb73b9c5b83cce072006ca3333d0414c57947ae
SSDEEP 98304:QY+LK3fO4FJPbZYT/UWzWCNaKp38VRqk9gvhrN:XP3FJCjxJkE0dOh5
TLSH
T129F5337FEAA4C1196302C263179C96F7BB09D6256E7F0271B702822DE54C3A7BDE4493
MD5 SHA1 SHA512 SSDEEP TLSH

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/loader.exe

IMPHASH f61bd2dbc36fca7fb1818995f8de8061
SHA256 1e9f9feb440b3112cea40c93a296ad1f085ffabd23799daaded9178497b105a4
MD5 cef5440e35fa65948550106705472ded
SHA1 245013225a235e25c441a42276ef5ac4a59acd43
SHA512 caf76fbaf22a89b3a7bee864470be4ebf86340029d50c974ef5be4d0aae0b291ed5bb68b6f26b28a0bfc04fd0be728a71bb888679ac5130413cfdc146428fd73
SSDEEP 768:JTwOu1bX3EpbYDydjpKISQCCLHxI/341aE+O9EsIpgta3lZBM+rDUMS:WRLIcyd9KISQCQxIvyB9ESu/BM+rDq
TLSH
T193536F947EA88C97EA11637E80E7D2666A3CF6D48B434F477B3439355B13F812EE5202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AddVectoredExceptionHandler DeleteCriticalSection EnterCriticalSection FlushInstructionCache FreeLibrary GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress GetSystemInfo InitializeCriticalSection LeaveCriticalSection LoadLibraryA RemoveVectoredExceptionHandler SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr log

api-ms-win-crt-private-l1-1-0

memcmp memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fopen fread fseek ftell fwrite rewind setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

820B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

512B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

122B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

512B

Virtual Size

372B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026].zip

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/78d4-1-1f7237

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/README_ANALYSIS.txt

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/loader.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic

shellcode-dropped-by-acrstealer-[tria.ge-26-09-2026]/run.bat