Extracted

• • Target
    Setup.exe
  • Size 672.3MB
  • SHA256 962bdc61115c4f4bbf4a70a01c5adebd457cab719013ab971b6ca09dfb345c84
  • MD5 815be0222c24053f41867b326df738b6
  • SHA1 60e43c9b9b0e450eb58533a3d12bc60849052ebe
  • SHA512 214d48fee5f6ddd90cf33e0e270aeb1e44a11511c574d3e5de4f6a38e4a7182011b3b9879e957570150c16f9a48951dcdc1c2aa4a545fd08a754a3e2fcf74063
  • SSDEEP 393216:zCw3bZuBXEkCOlFKFHyWhKUzzgGFdXMAGOhIAfXRjBZ5KYOfAxU4n:z1go5m4L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2