Extracted

• • Target
    QuickFetch.exe
  • Size 1.8MB
  • SHA256 8910f0cb2eb97c3b1ced8b512bb34884a958ba7d81829841b2e60eb487157662
  • MD5 55ecbb206e755651ddc70297948d8753
  • SHA1 6539df0786d917bd699e0b197a1b6f90bfc592dd
  • SHA512 a949281761cf35234323e929f6e1312aadb320fce429e7c348696ec4b3f39d9816a661d739404a716425d2016c4a4b4509469ae3b541645dc5ef87a14a61106f
  • SSDEEP 49152:og5kN/EgqxZczQWaHD5IpLvjj+Zsln3jjNqm3:owoEzIpSal3jxqi
  • TLSH
    T12395236013F4C4A5ECB657B598F74E63967078025A3EA7CF35E69D4A2F272C4893130E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1