Overview

overview

10

Static

static

10

8551bd2509...18.exe

windows10-2004-x64

6

8551bd2509...18.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
  • Size 583KB
  • Sample260814-wsjsbsycmd
  • SHA256 8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
stealeracrstealer

Malware Config

Extracted

Family

  • acrstealer

Version

  • 4.3.2-alpha3

C2

  • proxy.cipherlodge.cc

Decoy

  • keycdn.com

Attributes
  • guids

    5c40e790-36c7-445b-be10-91cebfdf9cc1

    019ff2ee-a349-7d59-92bf-b59e8cc86014

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer
  • Detects ACRStealer V4.x 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
    .exe 583KB

8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818

  • IMPHASH 6cb7c652105d9b2b2ff7b5309e0e37cf
  • SHA256 8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx86arch:x86

  • Detects ACRStealer V4.x

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
531475
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths