Extracted

• • Target
    17294ae5b3fd.exe
  • Size 6.5MB
  • SHA256 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f
  • MD5 4780771e3d27ff89d6f81648c197b8a6
  • SHA1 7e295dbfbb54c73ef9a1cb0d567e25043a4add21
  • SHA512 1d8f96ff993c4caa09508fa46f5367bca234ba1a0740dc22b3d582edb0217a283392469d733aff26c1cc6d346f961987e1927fd604a06912dd9252591db7e8ca
  • SSDEEP 98304:nX6hoeIhDcgndodDjuEfJhkt8sfeJ36/i5Sq54IizhvMScU:nXvhDcg+DjBJhq8H30i5Sq5UF5
  • TLSH
    T13966D02BF39B9536D48E067624B75325A37DE50443034BD763E8693CDE222F12F3A686
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerinstallerspywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2