Extracted

Extracted

Extracted

• • Target
    test.txt
  • Size 1.6MB
  • SHA256 45b1629991b76684752d1b68db2835384f696f714726c06cd6eab03eb1cb75fa
  • MD5 9b6d5c8a220132dce5aab425bb854aa1
  • SHA1 4e6584328a4daed4ad6f40a67b0d477c3cbd7111
  • SHA512 fb1456584168abf3e208960bc1fd5c595d48572dd7176703cbdc3de4ca4df2fd9c3b342026acee86c2d68df5c75f34820038ffcd1bb505b5c258d678cf0c3947
  • SSDEEP 12288:t1nBbP19eoV6cWRpHzVfWOCX39WORa9fn5UQeKKRoedJUzhwFtw+gGRN6EyUaIdl:d
  • TLSH
    T1B275F0523651FD7D029693B17E1646F0A86ACA40CEDF8596F24DCE8CA14DC823AF93C7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionacrstealerstealerpersistencespyware

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3