Extracted

• • Target
    setup_patched.exe
  • Size 2.1MB
  • SHA256 cb336a6e3fc0e9aa62b5768bffc207c09b372546636a5c58057a1b6d0708df06
  • MD5 bb8c32e7142b83eb891d2be7f20352cf
  • SHA1 501b5c01a55474d8fc07cff23b8c14108a690e71
  • SHA512 381e0626d18b20d7a12675fadce05edef03626fb41e99d895d3fcbd97ba57f834d9964f7d8ab71c22c9d450b6177c633a4b594a0dafc4c817aa4e865c3b2550b
  • SSDEEP 49152:09CUaz8YKb+hU58oulzMThQJ/z3ChDOgYYcRcfCD:0YFKiyKoAzWQpsOnyfCD
  • TLSH
    T15CA5331319ED0AE4FA795730A8F207139730FE562B7A878F1348D09F4F16AE1997934A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerpersistenceprivilege_escalationstealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2