acreed | 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c

Sharing

Copy URL Twitter E-mail

General

Target
6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c
Size 1.4MB
Sample260303-jv45tshs2c
SHA256 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c
MD5 e53b317dc1aac1e113be7f89ab4c431d
SHA1 ea708ef5ad9bd5e0c35f0cbe15d011a397466063
SHA512 9b88b675ffb4d522b1ced608e4505b3c21722641d4e6c1d07c0024b78240cd6ef90c6b15dcd162ad0c8ee03ffd37ee637e951b0b29babfc86aeabb184c046cf9
SSDEEP 24576:Pxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/II6YG0x2222v+:8/CQiGkeubLp+A+WxCpZlEoy63nIn/Id
TLSH
T127658D61B197C032D19642F0A928EFB6526CEC344BB684DBB3D03E3FBA715C1A634957
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

acreed

Malware Config

Signatures

Acreed family
acreed

Detects Acreed Stealer 1 IoCs

resource	yara_rule
sample	family_acreed

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c

File Explorer

6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c

.exe 1.4MB

6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c

IMPHASH 29c36a4c82d7d1ffd7acebc726a9f7f4
SHA256 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c
MD5 e53b317dc1aac1e113be7f89ab4c431d
SHA1 ea708ef5ad9bd5e0c35f0cbe15d011a397466063
SHA512 9b88b675ffb4d522b1ced608e4505b3c21722641d4e6c1d07c0024b78240cd6ef90c6b15dcd162ad0c8ee03ffd37ee637e951b0b29babfc86aeabb184c046cf9
SSDEEP 24576:Pxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/II6YG0x2222v+:8/CQiGkeubLp+A+WxCpZlEoy63nIn/Id
TLSH
T127658D61B197C032D19642F0A928EFB6526CEC344BB684DBB3D03E3FBA715C1A634957
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Acreed Stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

655727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\source\VIEW\Release\WebView2GettingStarted.pdb

kernel32

OutputDebugStringW LoadLibraryA WaitForSingleObjectEx OpenSemaphoreW Process32Next CloseHandle HeapAlloc GetProcAddress GlobalLock CreateMutexExW GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte CreateDirectoryA DebugBreak GlobalUnlock IsDebuggerPresent GetFileAttributesW CreateFileW OutputDebugStringA GetModuleFileNameW LoadLibraryExW LoadLibraryW GetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileAttributesA HeapSize GetTimeZoneInformation SetStdHandle ReadConsoleW GetExitCodeProcess HeapReAlloc DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle SystemTimeToFileTime TzSpecificLocalTimeToSystemTime ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetLastError CopyFileA FormatMessageW Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetModuleHandleA GetCurrentThreadId WaitForSingleObject CreateMutexA TerminateProcess GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW Process32First GetModuleFileNameA RaiseException InterlockedPushEntrySList RtlUnwind GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo WriteConsoleW CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle SetFileTime AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread LCMapStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

SetCursorPos IsIconic InvalidateRect ShowCursor SetCursor SetCapture SendMessageA GetClipboardData TranslateMessage GetCursorPos DefWindowProcA EnumWindows UnhookWindowsHookEx ReleaseCapture UpdateWindow RegisterClassExA UnregisterDeviceNotification FindWindowA PostQuitMessage GetClientRect ReleaseDC CreateWindowExA GetWindowPlacement RegisterClassA GetWindowThreadProcessId GetMessageA LoadImageA DispatchMessageA GetWindowRect LoadCursorA DestroyWindow GetDC SetWindowPos CallNextHookEx GetSystemMetrics BlockInput GetActiveWindow ShowWindow IsWindow OpenClipboard SetWindowLongA FindWindowExA CloseClipboard SetWindowsHookExA GetWindowTextA RegisterDeviceNotificationA GetWindowLongA MessageBoxA LoadIconA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister

shell32

SetCurrentProcessExplicitAppUserModelID SHGetFolderPathW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize CoTaskMemAlloc CoInitialize

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile

Name

.text

Size

887KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

igy

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat

Size

30KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

wininet

generic