Extracted

Extracted

• • Target
    f3761ae2ffb508e1df76e974692226ac38b368b213349e2969d72fc49f51ea7a
  • Size 2.9MB
  • SHA256 f3761ae2ffb508e1df76e974692226ac38b368b213349e2969d72fc49f51ea7a
  • MD5 d5254b68ad505660d433d8eed93c371f
  • SHA1 c41da0cd9d017f4ff38bdfbd19e8f7ac6d9e2a0b
  • SHA512 afbbfd06f506e7c53fcda267c811e59f6f219ebf7833c1aa126f579a5fbd97d598db43bc4d36a4849584ca0675d02d150f0b4e665cd72ef5a50d1bcdcfcd0063
  • SSDEEP 49152:/LDANbVYqBDXfQnjI78Va/DwMRYXebQhfBz:jcNbSafqSR/DwMRg1h5z
  • TLSH
    T1F1D56A01FEC755F2E503163154A762AF273AAD065F35DB97EA807B7AEA332D10832709
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clipperdiscoveryacrstealeranimateclipperspywarestealer

  • Detects ACRStealer V4.x

  • Detects AnimateClipper

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2