Extracted

• • Target
    SecuriteInfo.com.Win32.Evo-gen.95262865.exe
  • Size 4.9MB
  • SHA256 b038b23220a6948af729f5fe9243481ab0a16e8a27378c08e1bc6eb51c7398ac
  • MD5 56b09b7356441f70f08737347734f13d
  • SHA1 cfae11ef7a6a46d3cc47f8455afc49c02a726c66
  • SHA512 a8b214de916d86969f379651356ff392d8d5ff22f92cf3631afa88cbb57d744785692aa28f740cdaf4a85a120eab8a065d249f0a532b51dcd1eaf6f31539eb8a
  • SSDEEP 49152:Wli+6vJ4EXAy+2uH5HqTmr8xFO+kvYJMvg4oXHhyHPyF1xSCehG1D3DR855NxhEf:QoJ4OlSAxVD60lVEIv1IDxBaWC
  • TLSH
    T18B362A01EFCA44F6D5031B3060EB632F6339A9190B7D9B93EE503A6AFE673511C36649
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerspywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2