acrstealer | 6e725227cef911c315ce49b85f9a272dcd661eac9336a4bfd0848035c81f4aa3

General

Target
2026-08-15_2e81113425da33811c4f8f5518d2add1_coinminer_elex_frostygoop_hive_salatstealer_sliver
Size 5.0MB
Sample260815-b3qcmsxtcy
SHA256 6e725227cef911c315ce49b85f9a272dcd661eac9336a4bfd0848035c81f4aa3
MD5 2e81113425da33811c4f8f5518d2add1
SHA1 4dce69f4d8db5ba7a54965c977b5bc411a51d1f0
SHA512 8b3266214c4e71e813a0fa81687d7bea8ff6d14727910f91b9e5c880132900e299fbaed203c7f898a5b09b87105d2a1d205fe01fef19d264f1c4624261b09605
SSDEEP 49152:g6tHTlb5gtx7a0XDW5xkJHGTDuWQxL/bQpGkN9E0Q/N4V3IoGHqIQyGnlhHsPlW:NX5gt7exMHG2W1pdN3UN4V3OHaFnlFf
TLSH
T10736AF03EFCB44F6D8031A31E4EB636F67386D051B398B93EF547979BA732915822249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

acrstealer

Version

4.3.2-alpha3

C2

dist.binarypilot.cc

Decoy

azurewebsites.net

Attributes

guids
019fec52-13d2-7feb-b08d-2359860571f1

bc0af330-3975-4783-8aba-8cdc93c70f3a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Targets

- Target
  2026-08-15_2e81113425da33811c4f8f5518d2add1_coinminer_elex_frostygoop_hive_salatstealer_sliver
- Size 5.0MB
- SHA256 6e725227cef911c315ce49b85f9a272dcd661eac9336a4bfd0848035c81f4aa3
- MD5 2e81113425da33811c4f8f5518d2add1
- SHA1 4dce69f4d8db5ba7a54965c977b5bc411a51d1f0
- SHA512 8b3266214c4e71e813a0fa81687d7bea8ff6d14727910f91b9e5c880132900e299fbaed203c7f898a5b09b87105d2a1d205fe01fef19d264f1c4624261b09605
- SSDEEP 49152:g6tHTlb5gtx7a0XDW5xkJHGTDuWQxL/bQpGkN9E0Q/N4V3IoGHqIQyGnlhHsPlW:NX5gt7exMHG2W1pdN3UN4V3OHaFnlFf
- TLSH
  T10736AF03EFCB44F6D8031A31E4EB636F67386D051B398B93EF547979BA732915822249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery acrstealer stealer
- Detects ACRStealer V4.x
- Family: ACR stealer,GrMsk
  ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
  stealer acrstealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ACRStealer V4.x

Family: ACR stealer,GrMsk

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2