Skip to main content

ACR Stealer

Malware Family

503 indicators of compromise attributed to ACR Stealer across abuse.ch threat intelligence feeds.

Domains

274

IPs

109

URLs

4

Hashes

116

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
logicbyte.ccdomain
ureyd250425ft.cfddomain
lsakthu69u020426i1w.cfddomain
eaglehurst.ccdomain
tulipstone.ccdomain
bramblefox.ccdomain
operationsframework.ccdomain
um8e86140825vjg.cfddomain
hertzfigblob.icudomain
shgh.junkmancitric.icudomain
stream.luminfrastructure.ccdomain
motivate.starkmond.cfddomain
foot.trxzidan.icudomain
wss.infrastructurecore.ccdomain
homansicloud.icudomain
k6q4eom170425c.cfddomain
metrics.palefox.ccdomain
sableyard.ccdomain
telemetry.incidentcenter.ccdomain
eee48.ccdomain
88.210.14.69ip
185.100.157.204ip
147.45.67.154ip
89.124.85.209ip
45.89.60.96ip
193.233.113.146ip
185.157.215.29ip
77.246.99.223ip
195.26.227.103ip
77.238.236.29ip
87.251.69.90ip
178.236.252.157ip
147.45.67.91ip
89.124.79.28ip
89.124.82.199ip
109.234.38.250ip
147.45.67.76ip
91.214.78.85ip
89.167.47.162ip
45.150.34.0ip
https://primemetricsa.com/1518925url
https://res.gridstack.cc/url
https://muaklekcoop.com/ckfinder/php.exeurl
https://muaklekcoop.com/ckfinder/core/js/acr-g1upd-639159296668701809.exeurl
91f4d29bbd95d3f69bde9a5a92c85143hash
14b278902d4bd280d6cc89225437aff7984edbf6hash
fec23a611159c06ff8ad5df619497ab71a756cf6hash
6ebb1ee6895f8a5c50aa2de2765d3fe5df0e7df9hash
0c09c139f79368d432460b08f99610fbhash
f8a09b989de6f5f57a4a1666f1b0fb4d1b1175e624d35f9e3dd7805dc06ea52fhash
4c8cdacf7e5ec0657c281ec2b107af86hash
b17e88ed55e2a1d3b8e69e62b3208913hash
8a0ad7e1cf495189fc4d52d075870a7b8077ee90hash
2825198bfb35cf74f4a841f5dc4fb798hash
b2ab8825b84e6f0209cf713dcf7156c93ae82f37a6d9f0ca9072e228825c8d63hash
31cf473bb93abef0760d4992d45bafcd936edb7c26193c175f8491f8ffaef0e0hash
8cbe48fc14585b878bda6c568ae10e1c0f063034c86f868b3cc324354596d32fhash
948b712d99e0c5cad05416e7f13841bbhash
6c19930c2b6b2ec49b42399dcd8e477de347c010hash
25dc86e9721ef1cd5f03c28aa238c1852afb46fehash

Another file to check? Run a file hash reputation check.