Extracted

• • Target
    file.exe
  • Size 1.9MB
  • SHA256 b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739
  • MD5 d45dc255d9d01adb6756c104e989d6d9
  • SHA1 72ad987d04733238978c5b6eb9bf704f628969be
  • SHA512 483e382860ae1a3d685dfcaa2b2d0a0de8647a41497104bfd4c4cf2f12b067f0a6f411c72bb8badc692185ee6acb425840ac0ba42132ef6415205ce1a8e235b9
  • SSDEEP 49152:yZ2AwyOX+f0ViW2STOdD8n0ywQEiaCQn7HDzunKo:bE0+TglKiaCQnTen
  • TLSH
    T1AD95231167F4C0BAD4E74F7189F40613F331BDD11B3097CF2AA5A98A1B22F98A63535A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerpersistenceprivilege_escalationspywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1