Extracted

Extracted

• • Target
    2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver
  • Size 3.9MB
  • SHA256 ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94
  • MD5 68ccd17f80bcc61bec8759b77cb80b24
  • SHA1 2bc8a0dc10a195172f9ab72e38c4ef38c2aa1d97
  • SHA512 e6aa0c675ee9c61b815705bb8d58346dccaee28949bc6300e8ec34ff00e753ec29fd977aa4f385fdc17758f010821fd81b2ceeeb50c73250f8018a44e9af14ef
  • SSDEEP 49152:5eCZUR9nHrIiDPQf00yEi3o95Jg1rLbQpW:coUR1HrIiDSi5Y95Jg1rYpW
  • TLSH
    T153165B02FECB84FAE4032E3160E762AF2739BD050F318B57EE543A79EA772515C22655
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerspywarestealerclipperanimateclipperpersistence

  • Detects ACRStealer V4.x

  • Detects AnimateClipper

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2