Extracted

Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 1.7MB
  • SHA256 9155314a52c72e0b5c43e6eb061b212b5c2f827ce61130e1675f02c6aa0bef3a
  • MD5 74ac74e35ac92b4c333e9e109175f200
  • SHA1 7f5ced215382ca9b711690d0af93156f88a17655
  • SHA512 8b0b1c1393212faecf70a5dcd1a9518d8847c3b484374321063c39a37bd96bbc6c8a3a7f02afd5d80aeebb09cb6a61e763da63fbd3481afb1762f82986866cb4
  • SSDEEP 49152:mFiOZTQxQc0t2YwTaiKgLnumlbT8vabrlUX:n8TgLnu8BFUX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  2265cadiscoveryexecutionacrstealeramadeyspywarestealertrojanpersistence

  • ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Acrstealer family

    acrstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Amadey x86-bit Payload

  • Detects unpacked ACRstealer payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3