Skip to main content

ACR Stealer

Malware Family

469 indicators of compromise attributed to ACR Stealer across abuse.ch threat intelligence feeds.

Domains

254

IPs

109

URLs

3

Hashes

103

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
kelpstone.ccdomain
ureyd250425ft.cfddomain
bramblefox.ccdomain
csqv8f020426tlb.cfddomain
neuralpulsecore5.sbsdomain
res.explicittweak.ccdomain
9c93qxj2vi020426nw.cfddomain
motivate.starkmond.cfddomain
duskmoor.ccdomain
bytestream.ccdomain
sc.runtimeatlas.ccdomain
sableyard.ccdomain
pwcgc6140825i6b.cfddomain
5lztsv140825j.cfddomain
amir9234321id.sbsdomain
y87fvt1g020426i.cfddomain
byteforj.ccdomain
j7wu9ixq0e170425ma4.cfddomain
bytestreem.ccdomain
a4oqs65jw1020426za.cfddomain
91.202.233.210ip
141.98.234.20ip
193.221.200.80ip
147.45.67.154ip
45.89.60.96ip
193.233.113.146ip
144.124.231.93ip
147.45.67.29ip
89.110.115.9ip
195.200.28.78ip
178.236.252.157ip
147.45.67.90ip
178.236.252.151ip
45.130.60.32ip
89.124.79.28ip
147.45.67.76ip
5.89.60.5ip
91.214.78.85ip
89.167.47.162ip
62.60.232.254ip
https://primemetricsa.com/1518925url
https://res.gridstack.cc/url
https://muaklekcoop.com/ckfinder/php.exeurl
91f4d29bbd95d3f69bde9a5a92c85143hash
d252e8f0884cdfd7a81c26f2009b7719hash
6539df0786d917bd699e0b197a1b6f90bfc592ddhash
55086caf39129a111ae656fed7976469hash
9b4fc704f7a53929ab614c2fc68bb63b85f901043375914a4e92cd0a8d32d643hash
f3761ae2ffb508e1df76e974692226ac38b368b213349e2969d72fc49f51ea7ahash
fec23a611159c06ff8ad5df619497ab71a756cf6hash
3464135169dd3733163a502f959014adhash
6ebb1ee6895f8a5c50aa2de2765d3fe5df0e7df9hash
65fd2357119bd09ba317ea293b0414d05eb02a69hash
b17e88ed55e2a1d3b8e69e62b3208913hash
778aad49c1279d5a647759894155d40ahash
b2ab8825b84e6f0209cf713dcf7156c93ae82f37a6d9f0ca9072e228825c8d63hash
d1e5cbeac0e02e97a34aca7c9c54db5chash
0f06d82432a719e0079783e595dcd3f8277d1bd7hash
c1e8ea0ebbe41a5714caca4fc85046de84dd82553379c16b7f83b0c7fc8ce20ahash
46ced738ab9a9a37df3e36c6a8603742f26783f0be2fa845bdec10b5ddb50bfbhash

Another file to check? Run a file hash reputation check.