Extracted

• • Target
    𝟎𝐏𝐄𝐍_𝐒𝐄𝐓𝐔𝐏.zip
  • Size 24.1MB
  • SHA256 86f7183b3f1d4757a4ca2e32586eb8f79dea02732bc2ad66fdc1ca146eb6f5a0
  • MD5 2ad128de9e91f392f9e0854a02b93cea
  • SHA1 e1cd0fd4809912f1771717d9c5a0087dd0410545
  • SHA512 e433bb31b0a2ab41c10f577c91883bdc57d7c74c726ad77a18e76b4b55dbe7db9fb5cdf51465fcc22b2ee264f5443a6b1e6f53be522b7042d43951a8025e51f1
  • SSDEEP 786432:YGJpwLqPjok9cosaoXgDsGVruGGU2JsyEZiaMOp3W:YupwWPH9FOgDtVKLU27EXMw3W
  • TLSH
    T1124733BAE3272A81EEF50B825A55191D07C69626E811D1EFD00F8177FB3C2258E74DB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    SETUP.zip
  • Size 24.9MB
  • SHA256 2f58d559d2c4100384e2453a8e399243c81fb3352771dc2ed5384fcc6b482bc5
  • MD5 5afa33274a4f10df73ddcc85bb85cedb
  • SHA1 a308150165aca991f02259392935647fe0fb5e3e
  • SHA512 5f1ce9e97354e6f333b7b0c196854dc78548a6dc7cb04bbd6cf4764e70b826bcc62e3a5dff84ab9475443bb20cd84e3ceabcab09f7fb0aa9cb9b7531c2c599de
  • SSDEEP 393216:96kmrqrtEwLGI2pu9xWHVM3kGCRqgA2St9t5rN1Eu2CBWlYLVVCdC7pIzq4WW:9Y0EwLGQ93jUVhSXtb1EqWiLaxjz
  • TLSH
    T17D47330225E20F96D59E433CD2DB0B0732AC9F4F8542A32B47B8D66E3EB36B49F15546
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Setup.exe
  • Size 94KB
  • SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
  • MD5 eba77a34e9b8aa78fce520d1431fc68b
  • SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
  • SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
  • SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
  • TLSH
    T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    bin/QtCore4.dll
  • Size 1004KB
  • SHA256 2bb0d6fff88427e34c7d0d29e97443fe9826c42ce2aa0269f024b23d9e9ea22a
  • MD5 96213755b33c017492437ca934987207
  • SHA1 8e6f7c5d3ae9a0ea783e8ecb6bb69f827b903932
  • SHA512 dad2bff4d673efc34ceac3c4fcb3f67eb922302e67658e3ee9d6cd17ca31b8785b4745840f2f1030106b5184cd12140b3e7872a3e91d16e657e9ecbb3de8517a
  • SSDEEP 24576:eNeIBNL823deUvLNJngNphsq7OdyVgTsiovRMSN:AeIlHb4pPihTvoi
  • TLSH
    T1DA259E1276B318B7C4B2C3700D652F1A46BBC9334152CB9B739EBC1069762E676EB306
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    bin/QtGui4.dll
  • Size 3.8MB
  • SHA256 4e17c4962c29061c66300d5acf19e8fda28609f1eb69df8d2ffa2b69687895cd
  • MD5 003b7f5efa14c014ef8c66986fece1f6
  • SHA1 7eef91a39f9326f641d73374de26b41daea96d0f
  • SHA512 013479b4a930a6edad2379515022e06a845a049ec9551bef018a837bbb3ee6567267b1290af37cedbf5f76cabed9c1308e9203acd67fdb065f41d3f9d3856e8e
  • SSDEEP 49152:NG8tOCKR4CZO8VsDwRY0HDtURZO5paM3sLK0k8xMNmuvNGf6hAhTrOjXhWw49:rKR4CZO8VYZjRZO5pf6K0cQfB5rOjXh
  • TLSH
    T1AD06AF23B38700F3D6A7D3F01D4E232ACAFAE76545658747839C8D4166A2692F96F307
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    bin/diskpl.exe
  • Size 712KB
  • SHA256 32e08e6f5d643c02c2ad900a7ead09cefe6be5d9bc6f734e6bbe188445de9393
  • MD5 b0eb0f04d143007679108f66fb14bba7
  • SHA1 604473421cff4f1d2da9dd6d3b06760fcf4f6fa5
  • SHA512 8d88e88ee8d3366ae391d1ecd82c66709805b681c57c1fb5f7e90cf1d77b0965f4b37e3d672b9fc49d2fc120f74b7745aec7fe0178be07b5831361eb53cd243f
  • SSDEEP 12288:/3/U/WVOiPsgRhQfwLFem6FktB0s7iPkVigeBi:/3/cktB0s72kVeg
  • TLSH
    T10BF45B11B16F63E7EA84F2F10E1CA77B09B5A154AB25CF43D399FF12406D2607D2B21A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral11behavioral12
• • Target
    bin/diskpl.exe.manifest
  • Size 625B
  • SHA256 3de6abbb8353d358871beeb29866be857b723585b70de412c97c980961606070
  • MD5 b121cc719ac044a8b88a35bccb75d0bc
  • SHA1 1294bc018bdf96ffe6a111d82f63d43c671a549c
  • SHA512 faa5e77a693a1d6eb6036850e3cf21d2e14b75ce9002df2efe3a75f28318b9a0f7882264e96d193957de419087c280eacb7f98343d1f83d32dbb18bdec535c46
  • TLSH
    T17DF04601C8C4FD7A5A3645913EA6E500DB5D13230A88054A78DCBAAB5F76AABCB4707A
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral13behavioral14
• • Target
    bin/diskpl.flx
  • Size 1KB
  • SHA256 001d230bb2cca1def2ec9a513a70a2bbdc06072df76ab1f7777fb9ee07a16264
  • MD5 039ca3301c9bfa7859d02798cadbeca1
  • SHA1 d50caaf23c1ddebb545e4902155b8f118c933413
  • SHA512 a506bae9feff80f0a46dbbf6700ef8c72b49547389fdd705a99891683740b8798fedf640e02a767685658839b2557b607e929484d2aadee78b6703f2edd08326
  • TLSH
    T15411B645BB82C31EC60EB7A1F14211D072E7365D43817FBE8EC257D558E22CC41324A2
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    bin/diskpl.ico
  • Size 14KB
  • SHA256 f27d2ea1772cd768ec2c17815e1c698b54f40b0f7a87cfdc5f2de5d91e20c064
  • MD5 950f49caec3b35ef97582ae69e44bc98
  • SHA1 cdfc7477460d2aaa8dd0d5e58d8fce25dafc225d
  • SHA512 689fb6f11b387d55bc3cb285690229dc365c18a7b0b236e0f3547816343598cc730439ca6fea3c715f3319abdbd8366de81258a85ef81fb774273a7424c947e1
  • SSDEEP 384:jMKee+aQRR0Xdty9Ylf6dF/fbnMCTMMMMMMMMMMMMMMYddZ:PZQRR0N6sf6vtMMMMMMMMMMMMMMy
  • TLSH
    T1A862D87F7C861036FBE52C34736680BE4E582C9754A224DEE6BFB0D559B4F26C40239A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    bin/imageformats/qgif4.dll
  • Size 28KB
  • SHA256 fe8b67e424dafce5b6a2b8334d22f3b24126b957fce1d4c6e911b3f564161ba1
  • MD5 89ef1053c08539e7157ce24246a59200
  • SHA1 b0c6a7dcd2a425df0d23c1c899a2b397ae1c6591
  • SHA512 598dabf602c8496e029d0084156f8dc6f18e2b8d326e994962c1950336b164ff4de41ff1237f9586cf666aed833bc6fdbb0a0f89dde2e405478ef8e3cc44cb70
  • SSDEEP 192:3cMgHhWr3VGrvttv+/gwKi2RnvR0Dwf0wOOSwzu24IzvGfrWFrwyY:u4rM+no1p085BuwvGfrW9
  • TLSH
    T1E0D21A13F63A84F3E22213B5179B125BE37BA16152C68E5B4B43EC182C7D7667E3170A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral19behavioral20
• • Target
    bin/imageformats/qjpeg4.dll
  • Size 100KB
  • SHA256 bc82e8fe15670ada26d4f684d3cbe5f33901284bc366047722de8b7f62996a46
  • MD5 3d20fa8dd933c76ed5cc48544219099f
  • SHA1 1e28cf769f723404323f76e8ee7423c1bb679e5e
  • SHA512 c976ae78439ef224715e354aafaa23ff15bfb74e5968cb9424c12af6f69dca45d68dde6a319651fd39fa2c517017e19cf8a19a93d765e6d30090a42fab1cdb2f
  • SSDEEP 1536:krld5tFM0AfS/nrr+YRnudgjgMnzs3lviZ1pX0582VeQRgphkWVg:yv5nrAq/nrrjjgMzKYCiugvkWVg
  • TLSH
    T19FA3AE72F2610069C0A30375525FAF2E9EBE6373045DBB6707B869202B75AB5FF60285
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral21behavioral22
• • Target
    bin/imageformats/qmng4.dll
  • Size 188KB
  • SHA256 06f966e4f069d797dd0e629f7874fd8f11d9accedc9f5e68d4d81f3cee023a29
  • MD5 d5ae01409e4f9e54b39ad6ea1d8c2dd4
  • SHA1 fc4c114f9535554ac4bb275bd9190ce30e41a4c8
  • SHA512 a4967616641d8e284e410c506c5f2e52e8ae83f207fc1503cc914a3b19a2f0de5a51813ae727530ad1c817673fa2f0bef2ba44f0347b198239d68c1220ccaea1
  • SSDEEP 3072:Qy6GDeglXZAraG/kWVtKrV5swxQBhraCt7UXwQuT4npqp2dMHuf79TBP8UDXyWys:brZUkW/KrV5xQBhraCt4XwlT4npqp2d7
  • TLSH
    T11D148D9991EA6CB0D8C9067EB05B375EFFBD763A46455A5323E01ED0BEA02B0E50431E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral23behavioral24
• • Target
    bin/imageformats/qsvg4.dll
  • Size 24KB
  • SHA256 6e31a5592490e39c46bf379dceabe57219a246510367b8cff52f080ad5ac8dd9
  • MD5 6c73095e7a27dd9e45e15e5e9a852aa7
  • SHA1 39d17a2d5d6026d3152a63c3cb0082044e2b8381
  • SHA512 d1b8eba59bd21289cdac76f09a1a7d8de674cc514ad109edddc1ff0a0f5288be587d9e49dcc2df27fb99381ef48a342e6347b0dd94da8bd21386933ff92bb80a
  • SSDEEP 192:smfEg61syvkhCRCTmQT4NdQeR5irmWP4P:ogysyvkYdRR5irmWP
  • TLSH
    T19DB2D732C3EA94DAD3B253F41B69436BB5BAE06007E7A2538B13D9503DA8365FD51306
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral25behavioral26
• • Target
    bin/imageformats/qtiff4.dll
  • Size 244KB
  • SHA256 7ca868368b685167d90316b7f8c6b5f7c90eef8c08f3176bfa23d0ce7a298692
  • MD5 011e3fb1a74e1654970b530c9f3585f1
  • SHA1 cd526f69c7a88331c1d25c38d3db3de60b055b15
  • SHA512 329f31e761cd92b77c1581b7e1f5b0d15464c1a11e24afaeb1d0b6cafbbbe00492f793569ff1a906e39b643d46a5002ba40a65a267a98ee92f30e3106eb62818
  • SSDEEP 3072:jO21C3R2Ijr8jgtaxYzsyUdo0/n5xMTAIsaXKtCPlXKiXJ:y21KNjwjgtauzsjdoywTAIsarP4i
  • TLSH
    T15434E904CED18D6BD87442366AEBC661B677E48A7F12DB07E70C70303A517916A8B4FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral27behavioral28
• • Target
    bin/libmng.dll
  • Size 648KB
  • SHA256 3dfd6c5230a0b74622c8077ead5fa4736b7655b124f91949a1ad60cc8bc4d701
  • MD5 86f3f9bbc3888293cc150fefea0790ee
  • SHA1 5c873a1d18e043a12af51a203790985e8d2d8a54
  • SHA512 b5ba723d6e567f4a767cb4937e6d3ba0aacecb4a40dc3be4e1d5f05ad6517053e7d36fec0af14bb4b214c26cebbffa13a4fac90fa28a154f9c9076f3dcee9e55
  • SSDEEP 12288:+hb4aZ7lXysBpc6MxFLOIzVPKfqDPS6oPdOY/:YbnBq6MzL9VwCStN
  • TLSH
    T1DCE45C21B6AF02F7DA4DF2F5061C737B0A7AB2949728CB039359FF1A142D2527937606
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral29behavioral30
• • Target
    bin/libmon.dll
  • Size 976KB
  • SHA256 d6cab05386bdc63e96316b519715b1174143bee3de84cf936769d17b7b115f55
  • MD5 f17da8332bc3ae1e892e7942e756ff46
  • SHA1 811aff7e3f4971092db1d21be3eccedb7c5aa41a
  • SHA512 bd2a9305d63077e54935289bd8af84e7f7c55f2ff43d0a2bc4116a32e072647c52481c8d489b90370089c83d316448e2b8d50ca2958f149c71994b3774bdd4ae
  • SSDEEP 12288:V804/9FbGVcpMPuMgJ5e0GnQKNCbQNKrO9/OY6nkPiHVFI:m04/9VGV6MgJ5lfKN2q9/OY6pVFI
  • TLSH
    T16C259E10FB9A00FADD45B9F2293E37335E74C2469B11CF939329FE65186E2A1B41B11B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral31behavioral32