Extracted

Extracted

• • Target
    Setup.exe
  • Size 3.2MB
  • SHA256 18a2bf78aeed6e4f42e56c3b933d1326ec195aefaf29292c36a4e19cc23b0fb2
  • MD5 02d100919d48d9e54e3c906aa0d0a776
  • SHA1 c6dc4d1af2ae951bbdcb8671d0ccec20889f3aa3
  • SHA512 209dea60d9b482afc8f96dcbd6eaaa4f23bde1d464acc3a08120c96293184a511e03559dd5e6562a7acb2044ba7ed315604df0f361485fbc50d31724bd14a340
  • SSDEEP 49152:WJKTE4z9lbYS6yuKAZN1S+nIktxmxHPKheNs6q1ZGbL:WaEQfZGTGemhK0H/L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionacrstealerspywarestealer2265caamadeytrojan

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3