Extracted

• • Target
    Setup_patched.exe
  • Size 4.9MB
  • SHA256 86d344ffb3663de5bd232fa7e5553fd8cd871282e43210d2386186aa77ee3cf4
  • MD5 77d3d448602cbad4a781bf90740551ac
  • SHA1 1da93733a64972281d2a60927a9cb308a8b202e7
  • SHA512 e5ec4375a5dcba5548b24efb2adf90bc8b44d904192701df8a24240075a9f586a34ba9425ce9f0c1b00c594cf62ae1a249f99a55467fc1ec30e73f1c085d9bf6
  • SSDEEP 12288:u0azTBfj34N6UqwrfVOB/FxvNuFHTGq6ua0S9TN32PlMmTO7oCJ6:u0azTdjo0zwiz2Haq6zNN32LyJ6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  acrstealerdiscoveryspywarestealer

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2