Extracted

• • Target
    930600062.exe
  • Size 5.4MB
  • SHA256 9705bd691a0be1f2fdb19b72b12e25097c39ce9c2173c3d5e7b106b4e97fa548
  • MD5 578a002dc5631dc1b34773fd828a0f02
  • SHA1 d4bbc90188af74bf2d0eeb0feb2ff37de49e5ceb
  • SHA512 dea55eaf6e98755d4e00200af7f3fbaea79408ca2f113fa1fc254134867f73dcc84464d0f7a68a55db879e33a727b689ba4561747575d1244b1f45106cda9d8c
  • SSDEEP 98304:++ON+Col9cCq/sKIyA0wyhCZ6HByYFaEUmFJxGsNq5zL:++jmf/CyA0V/EYkEJFJxGQq5H
  • TLSH
    T18D46D03BB7A4D52AD41EC23998A6E758B437F0705F3282DBA1D9235D9E375E00E3D221
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerinstallerpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2