SAMPLE_ACRStealer[.]zip

resource
unpack004/python37.dll

resource
unpack004/python37.dll

resource
unpack004/dll/AcPowerNotification/System.Runtime.WindowsRuntime.UI.Xaml.dll
unpack004/dll/AcPowerNotification/System.Runtime.WindowsRuntime.dll
unpack004/dll/FilterDriver/x64/Win10/ROGMS/AsZip.dll
unpack004/dll/FilterDriver/x64/Win10/ROGMS/EzULIB_UFB.dll
unpack004/dll/FilterDriver/x64/Win11/ROGMS/AsZip.dll
unpack004/dll/FilterDriver/x64/Win11/ROGMS/EzULIB_UFB.dll
unpack004/msasn1.dll
unpack004/resources/app.asar.unpacked/node_modules/@img/sharp-win32-ia32/lib/sharp-win32-ia32.node
unpack004/resources/app.asar.unpacked/node_modules/ac_node_addon/build/Release/ac_node_addon.node

SAMPLE_ACRStealer.zip

SHA256 1677c4583b09ce206b283644b360a91a26c9d0f2e9ca440b253ab3c8c1cdbd41
MD5 f13af101b057c2bd8679e2c1d3a0e235
SHA1 a2a7fea645124d0f7a7a078af442d134f0988281
SHA512 ffe348451010b2a6b707228f62e8341883b2d8cab81227a2e01b5b857ba358bbbbafcf800e006a0dd521af5d5d8728efbc95981a6947744f59991d03b4cdeaf8
SSDEEP 786432:oUGH5sJDXq3hNLSvVJ7xnNSRSL9zoVGrQbm6mnF8rrij:oUGZPV8VxxntL9GG4IF8c
TLSH
T13F77331D2293E3B02440B9A05CEFDD02BEA7D0E65C7DFA92C9822F1936DB09D13F6556
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1122

PASS KEY.png

SHA256 90530900b57574d2cd2a1ceb10eca336531485590f04b401dcb8c0e008638aa8
MD5 5df6b0eaf02170f6ef896e6bc7f07f3a
SHA1 6e32b8dcb8fb3956b67b743c56075892c78d0451
SHA512 2db1287d164ae5d2f2e5e6a5fca22cf18e4469fe5fce6a7f67c9ffab27fc18777433c2081946da63f82b93b78981f924b274085924b86644e11fe055d49f8e75
SSDEEP 192:bSSSSSSSSSESSSSSSSr664sDEV1TjwWQ5grhIdPVpjq0aTBnHSSSSSSScSSSSSSe:bSSSSSSSSSESSSSSSSuWEVdcWFrsPVpl
TLSH
T15CE16852C3A28867C46DE260B2A37DDD21B52786B2F0CB19C043477D3634D7FDE65A92
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1122

𝟎𝐏𝐄𝐍_𝐒𝐄𝐓𝐔𝐏.zip

SHA256 34d9090dfebb60a5c7a12d2ab5364cf2d940ad34670f90c0379c0ecf01c5eb6d
MD5 74413baeb3eadb83f89bb1cf80c8203a
SHA1 b332582364fb435c548b408dc591252046a543c7
SHA512 e8ddad1595aefd72b513747274724106a226dd41d97b4c290ba778b6771a7eddbd468b0e8f0b6319e6c74beef62ceacda99c0dd504f4991ecf79249c444e19a5
SSDEEP 786432:mUGH5sJDXq3hNLSvVJ7xnNSRSL9zoVGrQbm6mnF8rriS:mUGZPV8VxxntL9GG4IF8T
TLSH
T10277331D2293E3B02440B9A05CEFDC02BEA7D0E65D7DFA92C9822F1936DB09D13F6556
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1122

SETUP.zip

SHA256 7c9a76145f39a052020aed4eb60927ad678c792c15bdf4f192d36a569e0457f8
MD5 7f4e7a8e3266a147353d47a6c6f95fb9
SHA1 80caad03cd2b385f911982b806eae1906b2a2d2d
SHA512 2019b08ba87ca0abda7861a31b977f37f36d11660530f1a30e5e8fc9d63c34bfd874d9cad8e6aee0a0ccce3c62b6e59f59bb9e0eb564d418058c6907ebc748a1
SSDEEP 786432:EMrRVxNmoiMPv1tboni7vfbAM/4jm0ZtEnLkHSiZHMswlbyUoRYFmIC+:EERJbJzHbom0XUL8SiZHMb3oRiJC+
TLSH
T1C5773325F8293261F88DC6B405B01AA813E4BD71037F27D42274756FCA67F6C9F69A38
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1122

Setup.exe

IMPHASH d5a9e56a76478696cabdca1ac70dc402
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

1122

Digest

77:5f:02:1c:4e:17:5b:3d:e6:11:65:96:42:bf:4a:56:7e:38:5a:19:1b:68:26:da:e0:fc:ff:f3:21:73:9a:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Chains

Mar 10, 2020

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Serial Number

03:3e:d5:ed:a0:65:d1:b8:c9:1d:fc:f9:2a:6c:9b:d8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2018 - Dec 22, 2021

Minor OS version

0

Major OS version

6

Entry point

4761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\A\18\s\PCbuild\win32\pythonw.pdb

dll/AcPowerNotification/ACLOGGER.dll

IMPHASH 52def784bc38f8cb4dc442a1d2161380
SHA256 eb46b901d54d9548218e82f90c3b5b6fc347801344f2e4c5986b0b68dd580c6c
MD5 54acf68ba59b9d59598b2ef1e1733f87
SHA1 2db5c11e311a5db9a1f9314b26c5ea04bc2a7384
SHA512 f13b785f5ff7c7da2acd436fc06e9be26f49732c5e994120df3c99874561ad4dca38295cf9aaa193c6ce08aafa74622c3e9536b3336a6899f6e442b93c1bb8dd
SSDEEP 1536:ltGi4GjeFom3j5yDbHMfpRamaptLkNX9l/7gxf:5e2mwHMEp1kt9l/M
TLSH
T1F8535C927B05C4B1EA59037074A57BB7C57CBC65ABF046C3B7D78E194A202F37930A2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

1122

Digest

f7:f0:a6:cc:d2:98:dd:22:d2:d4:14:53:91:af:65:df:5f:c0:54:f3:8d:97:0f:d8:39:e9:3e:5c:f7:c3:93:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 30, 2024

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2021 - Oct 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

32532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\ArmouryCrate\Projects\AC_AcLogger\Release\ACLOGGER.pdb

kernel32

SetUnhandledExceptionFilter GetCurrentProcess LocalFree GetFileAttributesW FindClose FindNextFileA DeleteFileA FindFirstFileA GetCurrentProcessId Sleep ResetEvent CloseHandle WaitForSingleObject CreateEventW OutputDebugStringA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter UnhandledExceptionFilter

advapi32

RegCloseKey RegQueryInfoKeyW RegQueryInfoKeyA SetNamedSecurityInfoW DeleteAce GetAce BuildTrusteeWithSidW FreeSid EqualSid AllocateAndInitializeSid GetNamedSecurityInfoW RegQueryValueExA RegOpenKeyExA RegNotifyChangeKeyValue

shell32

SHCreateDirectoryExW

msvcp140

_Mtx_lock _Mtx_unlock _Mtx_init_in_situ _Mtx_destroy_in_situ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Throw_C_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathIsDirectoryW

vcruntime140

memcpy __std_type_info_destroy_list _except_handler4_common memset _CxxThrowException memchr __CxxFrameHandler3 __std_terminate __std_exception_copy __std_exception_destroy strrchr memmove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fread fwrite __stdio_common_vsscanf fclose ungetc fgetpos __stdio_common_vswprintf_s _fseeki64 __stdio_common_vsprintf_s fsetpos setvbuf fgetc fputc fflush

api-ms-win-crt-runtime-l1-1-0

_initterm _beginthreadex _cexit _initterm_e _invalid_parameter_noinfo_noreturn _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime _mktime64

api-ms-win-crt-filesystem-l1-1-0

_wremove _lock_file _wrmdir _findclose _access _unlock_file _wfindfirst64i32 _wfindnext64i32

api-ms-win-crt-string-l1-1-0

strcpy_s wcscat_s wcscpy_s

api-ms-win-crt-convert-l1-1-0

atoi

dll/AcPowerNotification/AcPowerNotification.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b5a2e89a8c9af0d2cac3ee3b018f50ac14129f6a2328055d23125f8bbf90a4f4
MD5 e30ec068964ff0a0f52268e16e5c2ab0
SHA1 d3706244a4cb5c5a79eae4007c04ad726b32b78a
SHA512 d82d9d1c0a41163bed828680436544d7de47ab6abd0404fb1865ac0ce9568c96822cb69402f070962e61c558bf2f19ecc182a7fec902afada014c1539c922efa
SSDEEP 6144:1+wczVu2VfoMwWJZuYROzGIc2UCvYh87T896o6:1+wcNVlwyQYR+hZvYha496o6
TLSH
T1AD74AE816BBC8E1AD1FF4F3D0C7A122065B2FC566952C24CA8A6794F4E3A7C0D965733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Password

1122

Digest

2e:a0:7f:47:eb:49:1a:68:a8:34:81:f1:9b:09:7f:b2:b2:f9:e6:32:cb:7b:50:65:74:2e:2f:8d:28:c6:98:6a