acrstealer | 223b65ac4158c6b75a84bdb6b91efe60770e41fc9a5db47acd0e4d0c491d6ba5

General

Target
223b65ac4158c6b75a84bdb6b91efe60770e41fc9a5db47acd0e4d0c491d6ba5
Size 3.7MB
Sample260807-h396dasygv
SHA256 223b65ac4158c6b75a84bdb6b91efe60770e41fc9a5db47acd0e4d0c491d6ba5
MD5 52968f3b5645beb7f1b208dd3f84678b
SHA1 e299da7f96a41f5104bad5380ae02e7edead3a9b
SHA512 b43be78a2b9d781d0b1e2d70e0a235febd514983802b0f017ea43bb4c1441c654d81bff391f80d806abc7054444dc5ce18ea3b689e688619cb8b46cdc9f80ba1
SSDEEP 24576:AiisMO2LtQDlW1I/OpHjYj4O9BQ/EZHcbDYGpYERZh59yDTU8Q1EAxIFKqsMG:AEkQwXQfGWhINUTz8
TLSH
T15006807244821F1FE96C00FD2F1E7BAD899E8B2A3124B069810F54E573D5FAC4D64ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

acrstealer

C2

rept.seescanf.cc

Decoy

advcloudfiles.advantech.com

Attributes

ddrs
https://telegra.ph/Functions-04-03
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019d5422-4706-774a-b979-f5ffb6a3d96c
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

add.hex

Targets

- Target
  223b65ac4158c6b75a84bdb6b91efe60770e41fc9a5db47acd0e4d0c491d6ba5
- Size 3.7MB
- SHA256 223b65ac4158c6b75a84bdb6b91efe60770e41fc9a5db47acd0e4d0c491d6ba5
- MD5 52968f3b5645beb7f1b208dd3f84678b
- SHA1 e299da7f96a41f5104bad5380ae02e7edead3a9b
- SHA512 b43be78a2b9d781d0b1e2d70e0a235febd514983802b0f017ea43bb4c1441c654d81bff391f80d806abc7054444dc5ce18ea3b689e688619cb8b46cdc9f80ba1
- SSDEEP 24576:AiisMO2LtQDlW1I/OpHjYj4O9BQ/EZHcbDYGpYERZh59yDTU8Q1EAxIFKqsMG:AEkQwXQfGWhINUTz8
- TLSH
  T15006807244821F1FE96C00FD2F1E7BAD899E8B2A3124B069810F54E573D5FAC4D64ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery acrstealer stealer
- Detects ACRStealer V4.x
- Family: ACR stealer,GrMsk
  ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
  stealer acrstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ACRStealer V4.x

Family: ACR stealer,GrMsk

Badlisted process makes network request

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2