acreed | 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.bin
Size 1.4MB
Sample251002-gwrvsaxybw
SHA256 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0
MD5 2e619fbf9ae1040838fe4933dfe757c6
SHA1 7c5482e43bbd167d1e7f38f173e2bdf0a525cb5f
SHA512 dba3eb8ad39e7d25b9fbea472cc6badb7479577b282453ce4f670090bbe9641c7bd6bf986a727a92969ab66534a9a06807e32a817c5560b3d6f710de36b19533
SSDEEP 24576:Wxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/INuYQ0x2222v+:x/CQiGkeubLp+A+WxCpZlEoy63nIn/I6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

acreed

Malware Config

Signatures

Acreed family
acreed

Detects Acreed Stealer 1 IoCs

resource	yara_rule
sample	family_acreed

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.bin

File Explorer

31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.bin

.exe 1.4MB

31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.bin

IMPHASH 29c36a4c82d7d1ffd7acebc726a9f7f4
SHA256 31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0
MD5 2e619fbf9ae1040838fe4933dfe757c6
SHA1 7c5482e43bbd167d1e7f38f173e2bdf0a525cb5f
SHA512 dba3eb8ad39e7d25b9fbea472cc6badb7479577b282453ce4f670090bbe9641c7bd6bf986a727a92969ab66534a9a06807e32a817c5560b3d6f710de36b19533
SSDEEP 24576:Wxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/INuYQ0x2222v+:x/CQiGkeubLp+A+WxCpZlEoy63nIn/I6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Acreed Stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

655727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\source\VIEW\Release\WebView2GettingStarted.pdb

kernel32

OutputDebugStringW LoadLibraryA WaitForSingleObjectEx OpenSemaphoreW Process32Next CloseHandle HeapAlloc GetProcAddress GlobalLock CreateMutexExW GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte CreateDirectoryA DebugBreak GlobalUnlock IsDebuggerPresent GetFileAttributesW CreateFileW OutputDebugStringA GetModuleFileNameW LoadLibraryExW LoadLibraryW GetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileAttributesA HeapSize GetTimeZoneInformation SetStdHandle ReadConsoleW GetExitCodeProcess HeapReAlloc DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle SystemTimeToFileTime TzSpecificLocalTimeToSystemTime ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetLastError CopyFileA FormatMessageW Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetModuleHandleA GetCurrentThreadId WaitForSingleObject CreateMutexA TerminateProcess GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW Process32First GetModuleFileNameA RaiseException InterlockedPushEntrySList RtlUnwind GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo WriteConsoleW CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle SetFileTime AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread LCMapStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

SetCursorPos IsIconic InvalidateRect ShowCursor SetCursor SetCapture SendMessageA GetClipboardData TranslateMessage GetCursorPos DefWindowProcA EnumWindows UnhookWindowsHookEx ReleaseCapture UpdateWindow RegisterClassExA UnregisterDeviceNotification FindWindowA PostQuitMessage GetClientRect ReleaseDC CreateWindowExA GetWindowPlacement RegisterClassA GetWindowThreadProcessId GetMessageA LoadImageA DispatchMessageA GetWindowRect LoadCursorA DestroyWindow GetDC SetWindowPos CallNextHookEx GetSystemMetrics BlockInput GetActiveWindow ShowWindow IsWindow OpenClipboard SetWindowLongA FindWindowExA CloseClipboard SetWindowsHookExA GetWindowTextA RegisterDeviceNotificationA GetWindowLongA MessageBoxA LoadIconA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister

shell32

SetCurrentProcessExplicitAppUserModelID SHGetFolderPathW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize CoTaskMemAlloc CoInitialize

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile

Name

.text

Size

887KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

midwun

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat

Size

30KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

31856f84c73b66428547afcfb812051f45b32fdd4ca41fa005587356773a10d0.bin

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

wininet

generic