Extracted

• • Target
    SHFolder.dll
  • Size 32KB
  • SHA256 13c479b1a4e2da092811ec64179eb12689eb1a5a4078c59eee890f1dfb90eb24
  • MD5 1f0cbb7b7644967660993411af8baaa3
  • SHA1 c5a9f5c356db9f8a923ff1083603234911ebbc98
  • SHA512 9315c8b63e7d063ae88e5ba27d3de09b33134cf4e0fb8487d24797c64ec469afeabb4b4e3d338b4914ad1de6808f5f86b36e49e5b548864d49477fa188869f7a
  • SSDEEP 96:p0nivWPdbUp2QD6kvLHwxeIJ4/hsc5TfdswPcKJVYGKEW8MWw0vEqH:jMDULT+4/hsupswPdJ2GXW8MW7EqH
  • TLSH
    T134E2C84673758EA9F06257B9402B1A066E2571204BA346FF8330524B2DBABD4793DFF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Setup.exe
  • Size 10.5MB
  • SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
  • MD5 7dbe5a7928c4048d67413510bf15f3b2
  • SHA1 a6737313438f77142c2ac7c878dd40a31341d52f
  • SHA512 adf50f9432559b245c5029cbed4c91a8b0783078112a9f5985618ac6054b3f95e1c36b17fd4706c9e8eb01736205ca2e95d2c072e88f2fe7ffd5c6b3b1cff141
  • SSDEEP 98304:zOPwW4aV15KImMX+wP4UzFmt2a+sBZp5Fre0x7ahqR:GwW4ad6MuwPlz8Lp5Fre0xzR
  • TLSH
    T187B65C6F72A8C12AC16EC27EC1A78F50ED33B0B51736C2FF529052655F12AC49E7E660
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerstealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral2behavioral3
• • Target
    SspiCli.dll
  • Size 300KB
  • SHA256 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
  • MD5 5368a0eda501b5bd821bb55664d04f6f
  • SHA1 b43e4c935b2ecda48a88ff79868a41610f029cf4
  • SHA512 df26d13641892e5ac17951fcca3c4b9a85dd3974622907e32a08c03251fbdf21fdfcdf16a4d6f0b012dc226791a50d8087b52bda9a284fe3a797bb6a11cb0c86
  • SSDEEP 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
  • TLSH
    T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4
• • Target
    WTSAPI32.DLL
  • Size 1.6MB
  • SHA256 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434
  • MD5 a14313f547139025473612833687c1a5
  • SHA1 9c91b00f37e2c91ec52f60a7d3115ea824c6d2c6
  • SHA512 73b1fd2e942bb283b5d93735f4bfd07ebee6ddf68318a0b7aa5dbe3cad030411467074e461a11becf7abe8112b282cfcfe6a6a3b9b706a35fd5d48684ca9f7d6
  • SSDEEP 24576:3HMe8e18KimZP1k26rnWodwwz6JreJRa6K1jytX7q3iVF1N+DU7DGb7ohyy:3Hn8eCRxldwwz6JCJwPgqSH1FDeowy
  • TLSH
    T13785DF05A3E80AB5D6B7D334CA675632D7B1785107709ACF02A4DA5E2F33BD06E3A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerstealerpersistencespyware

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    comdlg32.dll
  • Size 940KB
  • SHA256 277f03b537f9c808f573d29ae6089c1e13b61531329c25314a4513c93f5be67c
  • MD5 9fc5d875b32f15003a1b15fd5aa8d009
  • SHA1 e0a0e6d523ebd3dc950f4c860fa9e6c631de9bdc
  • SHA512 f8488a2abcf65d101dd5f43f32b7d1e25aa70e5f1854d693e0b3a0264c9cfc06a8537e508df65bd7391d208cc51469afc5328004547a0ba084579caeb23f4543
  • SSDEEP 12288:+3a1OBSpcy+lC8M2N8MWlYBeNVUOPFgKX1yT6wqD4nogilAYdUJ+SOf5fZpk7:LOBIC2MrQQKHUT6J4nonAY+oNlT8
  • TLSH
    T173255B1E26FC01D6DA7AD17CCA13860AE6B2747513226ACB0150C67DBF2BFE46539F21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7
• • Target
    mpr.dll
  • Size 142KB
  • SHA256 8bb319c8c8255e915c05c03eccc24981cf9653025d2f720fb7fffdd4d524309c
  • MD5 270e57ac9dbbd5ee4425532bfa4a9e50
  • SHA1 235e781c4b5d40fbe8cab0228c1c0976f5278a42
  • SHA512 a82bcb4cf3d5ce223370683c823f10de784d0d0f815cc6f37a3b05428bce0467c6874284ec3d70eee053f72a551866875ecf5971e285cfdcc35cd237e5a6f8cc
  • SSDEEP 1536:donUKXu43rN5KDnX56J/jMIR/QXwjyeJQ/wyI4jsAuBE4RM87ximtb1sZiP5zQG:qnRX/3bKDeIUjJQoyIPHj7xFtb1sYREG
  • TLSH
    T184E3282E76B93095E5BAC2B884525605E732B47123116BFF06D0CA788F277D8BE39F41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8
• • Target
    oleacc.dll
  • Size 480KB
  • SHA256 40d73e20a9f008aa05ac0d57c31f8513d01f21b8070ac201124a8afa8f82586c
  • MD5 7515532e5734298091a7d8831fb5bfcb
  • SHA1 ac0e058aab48dc56ec5a570c1af8e3bd9f7649c8
  • SHA512 d6af9b86ff0e1d8cc78ffe0df223a101aa1762de4914b03943992c163e3e76de2233e6bb84e6ab39ddf4122c4e17d6a7fc1ca873b28d42cd6008eca0717f859c
  • SSDEEP 6144:Iyzofc8zZzmfADzi+LjmCUtxU0SuXigOCF+HPyP0jQssehKuVb:/zQDX/FuygOCF+vyP0hPV
  • TLSH
    T1F4A4185E72A844EAC93AC17CC957420AD7B1B821175197CF1260E67DEF3FBE42A39B10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral9
• • Target
    winmm.dll
  • Size 215KB
  • SHA256 95f9d6069156740b12c125fb6f84e65de9a235b70c61369229f388c7cae8621c
  • MD5 aba93c1d598db2eb33a58503aa356acf
  • SHA1 c34d1f4daa75f8e522c62c6864d7ce3b502eb736
  • SHA512 dbe424060de8dd04e78b568b3cd993d782d49b7349ac4746114e27bac210fbb26dbe17e45e9130cca333a864e9c88cc7a6818819e09525f8a3ecd7511f169dd6
  • SSDEEP 3072:MKygNSd/Rd1gtxW/uTWC/Brx8AoanT6tnuY7BhT1hDzGR0ginHRRbyTZLhfZpk/:MJgURd1+W/jqnnT6tuYvH8inHuhL
  • TLSH
    T1B5244A6D77EC10A6E97B9738C8A24A15F672F8341B1283DF02D0827D1E27FD8A934B55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10
• • Target
    x64/AdonisUI.ClassicTheme.dll
  • Size 287KB
  • SHA256 8103f2cce6a864ceefe6c5b0c05087ac85ab04a2abf150e93bc9db90c54d9d20
  • MD5 8a1b183bca062f48402c74f2daba7b92
  • SHA1 d9417bf78b3b37d668c08e67f3c0f21dbc6dc11e
  • SHA512 0f5120fa9ed24d2a49b82cdc62113302002ccc5e1cf389cc28830f36b2915f876bdf77094fa6dfa312fc01b6f482465297fa734509511fa7e72285569ce57e87
  • SSDEEP 6144:aMNTja9KIKf5RCs1ussMKlzI5iJQn9gu5DPOvObo:5Za9KIjs1ussMKlzI5lo
  • TLSH
    T18B542B8429204C79DA368B7BDEC2A40D3F3D805C96F1A5176DDA3E5CDCAE24B0A2517F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    x64/AdonisUI.dll
  • Size 164KB
  • SHA256 db46b6106dc1b30041ce3f287ded91166895ff3f1928250fc79dd46c444b1e45
  • MD5 3d4c8b6aad28ec574e56ccda22b34ef3
  • SHA1 bc22ac7097e597fba3d7367b2fd5c61adff28941
  • SHA512 fc56241e65dc7bcc678a2af92f79bda017ceb3f7c4f203c7e9ce753d573da868608a6f56545c0d181a625737278b7b73223e5dcce85bf1f3c5b7b1b06e5c5739
  • SSDEEP 3072:fuZPAdWKbu3355s555GPQKljrKxX0yAbTxin1YzqHf0llbS1sjZ73h39Iwj:GydWDrKxG3h39Iw
  • TLSH
    T123F32A8423BB493EF7BF4BB4987520194F76E5971593CB0E4E8430ED9A6A70E06522F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    x64/SQLite.Interop.dll
  • Size 1.7MB
  • SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
  • MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
  • SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
  • SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
  • SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
  • TLSH
    T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    x86/BouncyCastle.Crypto.dll
  • Size 3.2MB
  • SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
  • MD5 0cf454b6ed4d9e46bc40306421e4b800
  • SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
  • SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
  • SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
  • TLSH
    T15EE57B0577F81E67E56ACBB7D1B14012D3F1F82AB363DB5B5882633A1C13B805D826A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    x86/SQLite.Interop.dll
  • Size 1.3MB
  • SHA256 83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
  • MD5 8be215abf1f36aa3d23555a671e7e3be
  • SHA1 547d59580b7843f90aaca238012a8a0c886330e6
  • SHA512 38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
  • SSDEEP 24576:eiDAYMz2epP8AEXn8z7qsyb8c+gntHKuvKtBLtTvD0nsrFSK96fYlYyv:1AYMza36enEuyjpTV96A2yv
  • TLSH
    T1D5558C26FA8390A1EDD610B592FE6FB76C3D120A431808E7E3A41CB55A601D3767E74F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral19behavioral20