Extracted

Extracted

• • Target
    BugSplat.dll
  • Size 296KB
  • SHA256 4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968
  • MD5 27d48c6c48d5259a4e2ad7be369ce906
  • SHA1 66ea6266024a66826a9dd57a1420b8ce6fd13b0c
  • SHA512 a037c86bb33b98d768c27d975bc27be348382e75f4bf96d736d2f3bbcc02b7da9dc922994502fad1eb8f80d4df791c2c0e826b55b68c20580a46b1a0fe2cb43f
  • SSDEEP 6144:zKNX3re4rLmb8Gh8cGLdutlE7ZWeyFEq0DQtzYtRVljQ:zKN6emgGh6LdGwWJFE9ls
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral1behavioral2
• • Target
    COMSupport.dll
  • Size 59KB
  • SHA256 b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191
  • MD5 976ef4af05e92e4dbb612756e6798a37
  • SHA1 b6eeeab344272c6e9965820d35ca596703a311d6
  • SHA512 dde2923cf55dbd7a9eecd4a114d475008123d433a003ea71da0c50e9ec557fe6dc270e26d97c9076546ba225a9388e303330e601ecaa11dda4e812809a9665db
  • SSDEEP 768:8qr8sIYRM5ZJi9nCJELr6p0KkR7Dp4iUcj3QcYUyQaQIbPYTdRcmt3uo:8qvMi9T6fGmbcbjqmI8TdC03
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    DBGHelp.dll
  • Size 968KB
  • SHA256 c1275ddf04a0942b416c1a0b2d32003a4eda732c6f97c74181c236e35d12420f
  • MD5 3094481f0cb0531b407d2388ecb4b85f
  • SHA1 b2ed7c1895e417e0620e1043a8d3fcc4598fc791
  • SHA512 34b78729403e16d5ac1032cbb85c5c68f61f2f35b6e57d6d5ea2bc372981e93a1425b46a2c2dd55ed2b2e0b8681f517103e30a86241aec037b1e1788c411252b
  • SSDEEP 24576:cJ0P97FW0NnWpUBBgXRKQ7O7DVUY1V/IMHfyUO:c0PhFVNnWpUBB4i2o7O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    DVDSetting.dll
  • Size 41KB
  • SHA256 718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549
  • MD5 05c88530d48f20ec24dbc4df3470e57d
  • SHA1 44cd6ee8ca8c0ffaf9313a0c24bb781dbc4f3849
  • SHA512 e7654ee6a45ac5c150b9c1b98d530e2c9ca6e89a836408d1435826979b5e009bb6d630c9ab9b6ed124511449754c5ec67181d91c8f96c3e00c7f5179bf2a9675
  • SSDEEP 768:/8qXvDbWzd3vbJEl6s1Tl4jxl01SGoMRuuwV:Eq6dfbJE1T2aSwRuuwV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    ExceptionHandler.dll
  • Size 128KB
  • SHA256 6036be1c9a8819998ad10879dff6c04edc787d34a142a3e0841c0fca36fb9c6e
  • MD5 7c76e3100bd67c47f176a0edde3ef79a
  • SHA1 bff22f39f3ba61cddd695b8a27b5139c5675afba
  • SHA512 a9508ef760f5bba22aec0f2784258a364b372ff163bebf4fc59cb4d48c7ac6e68a96b7fd64dddb522dfa4c34f7ad652d8779232dd0db7609fb4b60cc1f4c2bbf
  • SSDEEP 1536:ReLbWzby5i5Zqyt4Q1H9JFXHSFUNNRcZZ36mCcTSkb0EYsKK93BFZ2nQ+iFD+b7:8v+iNPQ1H9JFCsIdjWK9RFZB+iFD+b7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    Installer.exe
  • Size 646.4MB
  • SHA256 aa5168c20c885a7a7778246f9de51f279b04615b8feafba5bccc33cb9ffbf92f
  • MD5 d4063c30c4af689cfc39f4f0a36bbb1b
  • SHA1 3de063c41dcd58503a14bd1b3441b16cae717492
  • SHA512 67be35c7f2d5a5d96d0a796a785459bbfbe2d8ce20fcd3a40bd0350b6a6113dd473e86feb9e9e1754ec15022c5469d4328f51dd849f43b6a45a66187a778f232
  • SSDEEP 49152:PF/cxnIol/BiheVDSAPLqn0oehQUvFgQsVLWQiEIryw3tYq/CR3Pum8kjQv7q7Id:41HTVNPL0N3sl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral11behavioral12
• • Target
    Library/AdobeXMP.dll
  • Size 957KB
  • SHA256 f6e584a509a991c3eb11a8d49b705def6bd43761a4b603a2b3b3703fad179a30
  • MD5 e4599a47906608651c920f535fccb359
  • SHA1 0e0a56b713c6c25c129c05511f7056676079fd8c
  • SHA512 4bb9518e0f34417293a291370d4d5308b605df7134f924847b6be2abfa1060a6a81a47dae47135f7fe879762d563eba82ae18ff3e452e8f461bc40f55f4c7e58
  • SSDEEP 24576:m4NrETP/kM19qqO/KFzl5lPxSsRivwKrfP5bsf+:m4NrETP/kM19qqO/KF5b/ivwKTP5bsf+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13behavioral14
• • Target
    Library/AudioRenderer.dll
  • Size 798KB
  • SHA256 63055ae72febd0b1a1fe9e9adc21e0201e1888b10da552690de14928374ab658
  • MD5 93ee9ae6c6d823afb04cbe08ef1a1392
  • SHA1 733fdf559ffedffa1194dce1bc0e9a20d8fe1cd0
  • SHA512 e5cdae4b1f084c4a69dc4157038b3075fdc8a4ea2e9566bbcb29fd362c149bb26e87cf09815514ed597320a8ec8df7c522334312c97dbec260997fc82dd50b8d
  • SSDEEP 6144:LmY+ze2VmiZEwH1ZaAE1f51mdXvI08TyT11xBjgycKmsrCFUGuXRzVB5O/PhrO9p:L36mxjAEd51U/X1rJgrj8BznPqrxQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    Library/AuraLayerManager.dll
  • Size 160KB
  • SHA256 13d6be93ec376cb7eaa7d585ddea23b0b46ea36a2ec99791d7b3c88cd4269c61
  • MD5 fd72d9653eb08492a8221392cbc3a457
  • SHA1 6f1026087e47f6e803044733348c1d1b1331f7be
  • SHA512 4c61f2af22cd26a8a3344a236600cca22e844acaca9224c4ead917d5ec3f7912f4be07f32148584cdcf1948976c6652ec8bf608496318e6068d4ee3073ae23ed
  • SSDEEP 3072:pRDB0CnYY/YY4YYHYYP8qFFr71Lw4GiZStOFLnSO9N4c6gdsEng8ZYG1yK:pRDB0kqFFtP0ibFD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral17behavioral18
• • Target
    Library/Azure.Identity.dll
  • Size 304KB
  • SHA256 b3c7a521e3829de15bc8daf15c2cbf8e8cb5140f87f02834514d685b0a968956
  • MD5 8b92e9cbc7e04e95dd5801b6ff1ad081
  • SHA1 a8cf3357228b41402750d3e6aab2b4284e7889b6
  • SHA512 5b608a54a813383ef83898e6c64ae26aa4799fd8f865eab092616fb0c4c3e599aa7785c4c92a5a628cb368aacdec71bb5daed2a12dd8378948181b2f4915688a
  • SSDEEP 6144:SVW38Bydqdix/jsSuTvWW1fgcccHAO2z+5:H/jfCyQ5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20
• • Target
    Library/BoxService.dll
  • Size 336KB
  • SHA256 56a903cd854f65bb7d8f27498f147ef20842e6576012cffe50d49f005b913681
  • MD5 72f06aa78ca77ac2094d3e564a017d3e
  • SHA1 f4935beb781e2200b78721463923c33ed82e6844
  • SHA512 5ebc5d527e8ac5228547ef275bc3ff6940931bd976b5d61080f1740257ba5e8dcc6aa3d9e3a0114f07617b5b2ef3240e75f805af6d06642fb29bda7ae8eb9974
  • SSDEEP 3072:KdecfEn4ZHlDa/tcnzJ55Rf0fMMMii+PfhOqcGaUH2fjMe3XPhjXFBGZ14G:yM8lD9nN57fsSUHWN3ZVC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21behavioral22
• • Target
    Library/GRINTL32.DLL
  • Size 203KB
  • SHA256 1b7eacf041fce0ef4b48ea3aa8afe885fab0324c7de51e07144ab4d4ee82c36e
  • MD5 f7f83d6f4e29b27a42744560a16a37cf
  • SHA1 53283741fb7cc005813a6cbe1c6c0982f5250373
  • SHA512 0a88fa0b6cd4bd053e65f5b013dae06cdf881796ad845d844a1638304ff6244a6bef073f90ce28ef691712fab8ae8fd6a553f3d7b25773c24b98e999bc872d65
  • SSDEEP 1536:Tx0ZfnVlbZATCg7GJTgLkfNBO71zHFUSz0PYBCDUld/d9sqUIHseIyTJICKkT+dD:1vTJIMLqG9lmgfdHM/xB95
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24
• • Target
    Library/InkDiv.dll
  • Size 350KB
  • SHA256 fd6636fe33a757689eba4c8ad56a5b56fd4a972c24d907442d9e2a7559b99b88
  • MD5 8c5bf2b676e6777158cadc210474bc33
  • SHA1 6c0d16cf95b9ca1344f423eef5e68a1f77cef6af
  • SHA512 816aec0bc5418592150d0902b0749fc176907f7f34b2ffd686f7bb52a3f595df47e7c544294a66f434fa6bc2d5eebeb6867ac738540c0f1c659e56ffc5778fa1
  • SSDEEP 6144:OJdYA7aF6pLqDKyDFxEXTcISEExItf5gojnC4rfhIrvGnQsjQDP:OAgUKWFiYIltfTT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25
• • Target
    Library/Microsoft.AspNetCore.Mvc.Abstractions.dll
  • Size 262KB
  • SHA256 9bb1201305a99fc6be9a2d90daed5b8b9e8db9c54a183eae9bccac14227a3ca1
  • MD5 7bc25b7b712fd3cccf6b2e9c696e3797
  • SHA1 80ce57df5f10c0f63eddc387cad9cae4e6992a05
  • SHA512 daa142c823d23029005a05d60e4876545458c2790bd86286026a0f474077ea0c7d86fe2924601467788c174aceb7f3652be4646983ba6841c8a07bcb605dad77
  • SSDEEP 3072:eVwCAhQ13ysRD+ZZPiJ91OWZfOJ+NaRg4IpXuWlkP7wowQFcjCQrwtzbmDoBn+Co:NFs1I0bZGUNaGGxwowGyy39o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral26behavioral27
• • Target
    Library/Microsoft.Azure.Management.PrivateDns.Fluent.dll
  • Size 265KB
  • SHA256 f30b0bd929e83cc5009060f8e11e2d85a0bc3da6d7e4a055ef7a7c96e3381c16
  • MD5 5fe3f4a36d695110d94b6b87ed5141b3
  • SHA1 20780cb15251bc928b3085d3fa35d1015b3669e2
  • SHA512 0a956e57cdea5c54e09147c43d8cf2c23be5f8d466a7fb47d0ae037c9941dd519cee6edcf84570b8e9842beaa4d122d60b9b5e8ac33d1a3526361c911846e35a
  • SSDEEP 6144:hbgUrDBM+HGQa+bCXMRNkrLH+Mdp0nhDCFJus5tjD+UQKX+EV63JMJi:tgUrDBM+Jak
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral28behavioral29
• • Target
    Library/Microsoft.Build.Tasks.CodeAnalysis.dll
  • Size 250KB
  • SHA256 458cd882687fa33df36ed423606c5422c903c39339d5ac708a82d2e3e2ac21c9
  • MD5 96cd53799793171f96bc702948a229f0
  • SHA1 44bac56d294457395606d73781d2076dd0dd7c2e
  • SHA512 d063c0e823faa14e30fd99fe0a6c55570bc61e9b9de2b64cb38c3929e245fe9fc025eb04a08c6b29f3d49cfe13e247d2ccd668cb2b4d7e5f18c7d7b2c5df0e2f
  • SSDEEP 3072:lgorgmIapjyPlLhzJ8LSyL6dMPv8i2WxTtzGLQ2dtkxj51L3KOW0I9J:CoapHJeSyQmc29GUJL3e0o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral30behavioral31
• • Target
    Library/Microsoft.CodeAnalysis.Remote.Workspaces.dll
  • Size 439KB
  • SHA256 e634ca4353d4a951bc136286ea2deb8fc73e435c4dc606fc3c29801734c4d29f
  • MD5 70a5e9c1e08e935771ffa077ec80a0e4
  • SHA1 4dac25f410c05b221d4085c442948ee4cabca0ff
  • SHA512 6f04bffcb3895ca61ac48af17332559bd9d05a5702be7fa5783393a273131ec41f3a143256df8986f19a4fc2f3dbbcee588ab4fd0eeb4fc1e57f446bccd67494
  • SSDEEP 12288:Dbsu0PHUlByTb3CH6O8cbkM2z53PEBdMxCOnh+Zoo:UorlA53PEByCOngZoo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral32