Extracted

• • Target
    86178936d27cb38a153fe543da255c7eeed37cdd1e12c062a6da8e2eb849bb05.bin.dll
  • Size 5.9MB
  • SHA256 86178936d27cb38a153fe543da255c7eeed37cdd1e12c062a6da8e2eb849bb05
  • MD5 ab447d1eafe679b8de44f64ff3bf45f8
  • SHA1 002a88dbb7efd03c7a7824308618a6a566fcb8bd
  • SHA512 36594eafa8c55d0c28ad3ea7b81f75850fcdd3268d22a78e5dbdb593bde63f2d55cb7bb652f7fca9363be1ae0c626aa4db28c7b6f683387b76254b7751d91386
  • SSDEEP 49152:8BYvboJtjLjGofSOo8IVhPoCIEdowTrTn0zadrCnpg/oIFzJAcU3LoCIlHggcfa/:t
  • TLSH
    T10A5609124E5C24A7D1E5C1FD25DA76C8CD9E48289AE877972CD381FCA5CEC2508CA2F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryclipperacrstealeranimateclipperpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Detects AnimateClipper

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2