Extracted

Extracted

Extracted

• • Target
    Installer.exe
  • Size 646.4MB
  • SHA256 aa5168c20c885a7a7778246f9de51f279b04615b8feafba5bccc33cb9ffbf92f
  • MD5 d4063c30c4af689cfc39f4f0a36bbb1b
  • SHA1 3de063c41dcd58503a14bd1b3441b16cae717492
  • SHA512 67be35c7f2d5a5d96d0a796a785459bbfbe2d8ce20fcd3a40bd0350b6a6113dd473e86feb9e9e1754ec15022c5469d4328f51dd849f43b6a45a66187a778f232
  • SSDEEP 49152:PF/cxnIol/BiheVDSAPLqn0oehQUvFgQsVLWQiEIryw3tYq/CR3Pum8kjQv7q7Id:41HTVNPL0N3sl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer2265caamadeytrojan

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3