Extracted

• • Target
    2026-08-19_b12644c29d3e2306e75c8d822d7b436c_coinminer_elex_frostygoop_glassworm_hive_salatstealer_sliver
  • Size 3.3MB
  • SHA256 b7a883b258d29e94008c5fbf71177d54a741b06cc22ce93f751c22c5511c5d80
  • MD5 b12644c29d3e2306e75c8d822d7b436c
  • SHA1 b899f5b64f80bb8c5048b7bec268515c8f6b95fc
  • SHA512 7e43e35ac032bc0aea0aa72b8fc55afdfb06f16b92535ff2d60a7dd5cf33e47ae54e808ebd2f211de19587872f57d2e443c5e5d7f36b1640a098db49184442f5
  • SSDEEP 49152:nr01Kb5gZgMccT87dG6MMuyB4LAfPaF+atibQlksJU4c:r15gZdEuePBatZl
  • TLSH
    T179F55B45FD8785F6E906263145AB626F2339AD051F3ACB97EA003A7DFE732911D33209
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerspywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2