medium
advisory
ACR Stealer new payload indicators
New ACR Stealer infostealer payload variants have been identified, warranting immediate investigation across host telemetry.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:33 UTC
- Detection
- 2 IOCs
- Source quality
- A2Likely
Three new file indicators associated with the ACR Stealer infostealer were reported by ThreatFox on 2026-11-04. The indicators are classified as malicious payloads. No specific delivery mechanisms or exploit vectors were documented in this report.
Immediate actions
Ingest and block the provided SHA-256 and MD5 hashes on all EDR and AV platforms.
SOC
4h
Threat Hunt
Search for recent file creation events matching the provided hashes in EDR telemetry.
medium
high confidence
hunt now
Data: EDR file_creation logs, File integrity logs
Indicators of compromise
1
hash_md5
1
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 59a72de45370f1fc1b6bc8d2a78ab538 |
| hash_sha256 | 51691f616ed51be9ef5eb8f52433321491c819a5b641433ce6c9d50168a226b4 |