Extracted

• • Target
    Setup.exe
  • Size 706.3MB
  • SHA256 2d83db8430c3f1518fd3e756a650154dd0e6fa167b6e1be8426c60d29d9d6777
  • MD5 bbe4a1d6f5d7ae97b0719c33f4d623a1
  • SHA1 621ad36c39332692b8ff9f1a7b30644d1cfb70f1
  • SHA512 c69adb587349a0a7124f68dc3b5f4c0afb5b768e3179d730f25190f61990cc4f204006169f53f17125a48bcbe2161f5a715036a22468f0e7fc9148c9168d21fa
  • SSDEEP 1572864:OTvcz/HwovQ7cTvcz/HwovQdcTvcz/HwovQ:hwSQ7jwSQdjwSQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3