acrstealer | c1de720316720b1afab276144ddf8c9e1bc9ef1d2ea8fb3f69967a8aa89b2888

General

Target
2026-08-13_1ffd61bd1bc6bcb6498bf0badb0f7e1f_coinminer_elex_frostygoop_hive_salatstealer_sliver
Size 4.8MB
Sample260813-mc49naxcra
SHA256 c1de720316720b1afab276144ddf8c9e1bc9ef1d2ea8fb3f69967a8aa89b2888
MD5 1ffd61bd1bc6bcb6498bf0badb0f7e1f
SHA1 99cdd5e427c6199d4b136b10ec7cb185329220fe
SHA512 1d6ad88eb668a86b921090c335ccdcdcd77d1c5901f534eb70d4d5f28920a7be7bf46c512eae279618168bdbfcf43e07395f4bce4ac0817cff7ec22d0e2fc989
SSDEEP 49152:g6tHTlb5gtx7a0XDW5xkJHGTDuWQxL/bQpGkNKG3udLxAd6tU3lg2qonFraHtEM:NX5gt7exMHG2W1pdNoLxAItU3JduHeM
TLSH
T180369E03EFDB44F6D8031A31D0EB636FA7396D051B398B93EF147979BA732915822249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

acrstealer

Version

4.3.2-alpha3

C2

dist.binarypilot.cc

Decoy

azurewebsites.net

Attributes

guids
019fec52-13d2-7feb-b08d-2359860571f1

bc0af330-3975-4783-8aba-8cdc93c70f3a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Targets

- Target
  2026-08-13_1ffd61bd1bc6bcb6498bf0badb0f7e1f_coinminer_elex_frostygoop_hive_salatstealer_sliver
- Size 4.8MB
- SHA256 c1de720316720b1afab276144ddf8c9e1bc9ef1d2ea8fb3f69967a8aa89b2888
- MD5 1ffd61bd1bc6bcb6498bf0badb0f7e1f
- SHA1 99cdd5e427c6199d4b136b10ec7cb185329220fe
- SHA512 1d6ad88eb668a86b921090c335ccdcdcd77d1c5901f534eb70d4d5f28920a7be7bf46c512eae279618168bdbfcf43e07395f4bce4ac0817cff7ec22d0e2fc989
- SSDEEP 49152:g6tHTlb5gtx7a0XDW5xkJHGTDuWQxL/bQpGkNKG3udLxAd6tU3lg2qonFraHtEM:NX5gt7exMHG2W1pdNoLxAItU3JduHeM
- TLSH
  T180369E03EFDB44F6D8031A31D0EB636FA7396D051B398B93EF147979BA732915822249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery acrstealer stealer
- Detects ACRStealer V4.x
- Family: ACR stealer,GrMsk
  ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
  stealer acrstealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ACRStealer V4.x

Family: ACR stealer,GrMsk

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2