Extracted

• • Target
    pui4410
  • Size 100KB
  • SHA256 e3cf263ad72092c68c1bbc6e8ec454baa7ec01b15fe6e4ccb19d2e49167ed35f
  • MD5 08f0b365b40fe35fffd2187e2bc3d4c0
  • SHA1 0ae8d714dd7b5a35ddbf7c8e68dee51a1ac56cf8
  • SHA512 f1d1eade7d5704a2d84b60e387a915d6c69378e18de5fa2fd2406f8f9f108c0c66afd7dfee369edae0adb2934b87b3d95dc1073f65b7f3b75e99a9a7a216e3a9
  • SSDEEP 3072:t/L/6Oy1umMTHaHgNiTErW5FZo5j0gqLVUFX76p1:LyDMTHKgNiTYWPZujwLupmp1
  • TLSH
    T17FA3961579E3A6F0288DCC7A0D88BD195694A03BC34B495C77CE5283AF436FC65F8A39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerstealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2