Extracted

Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 119KB
  • SHA256 daef1f11e3ef895923191a21bb1d9e4652a0568aa2651c97033ab9d3be9ddb10
  • MD5 bca13825411049cf5b942ba2decb9192
  • SHA1 ddd26f1754ae44b8f194ecf963abf8e5436d83f3
  • SHA512 c00dc2a4b242912da40a052e7ee0b45bfc5fdb62d712201a39dfc623b187f4c5a93cfde21ee7b85a54c5bdb56fc0021ef3110197ad1ba193e5ded1533876ea87
  • SSDEEP 1536:IBnZOvLKSCNIoaT4AhbcfkdOpLbdTqBiLDnlxZksXoEU8+scVvoa76Kw87ZsP:EOvLU63RSLbRjlgEU8+sqvoaR9y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer827ad8amadeytrojan

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3