Extracted

• • Target
    8026744df619b67e29f63749c14900d77d5d82c692e07d44ad25f08d00c28d99.bin.dll
  • Size 5.9MB
  • SHA256 8026744df619b67e29f63749c14900d77d5d82c692e07d44ad25f08d00c28d99
  • MD5 1d7f057b690fec38a39e3e70e6ed23a0
  • SHA1 6176a3c0d5b1acebea79700d388b5ea452801206
  • SHA512 9ee6af10702ae50fe97116d0b2e31ddf3f29fdc67e397eebefb2bb168f03eaad4613fb38ec7d8ea2bf7b8ff1ebd25af803bac65a5b7054ffafaa280148f43606
  • SSDEEP 49152:8BYvboJtjLjGofSOo8IVhPoCIEdowTrTn0zadrCnpg/oIFzJAcU3LoCIlHggcfai:Q
  • TLSH
    T1965609124E5C24A7D1E5C1FD25DA76C8CD9E48289AE877972CD381FCA5CEC2508CA2F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryclipperacrstealeranimateclipperpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Detects AnimateClipper

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2