Extracted

• • Target
    core
  • Size 74KB
  • SHA256 2f159c78415114009825a6a3c8aaf34251251d98406e892238fde5f051906d4f
  • MD5 7eaedec931454609167733a3e528fdb0
  • SHA1 5c74b5a16e3290ab4abeaefc6b257f01afb74095
  • SHA512 072897de01478785fe14e1e8cc7fa608437b48b9f0d6c4e9e205876217fe5d1d42bbf3f86ceb0ee2964bbdd49732c84d502385d2bed9e650d9d57a1c98fbd797
  • SSDEEP 1536:87CERKmTMVPHkK+66JXqhtHyzbcs2zTlqNIACS7u3/IwOheu:87CERZTMVPETpJXqLyM7lSIs7MI1gu
  • TLSH
    T19C7301313A9466D8319EC8B30F49E45C3AC8A223F259AD5FF68DC0CDBE4B6AC55E4435
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerstealerspyware

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2