Extracted

• • Target
    tool_0e649eaf.exe
  • Size 5.5MB
  • SHA256 923c28b4d0f8a2ed0d33e6a747d9b39818d5123d3e378fd1d72ed31a75dd5623
  • MD5 2c66cf69bc75cbc9b4a2f8fed4490636
  • SHA1 c211cd5eabf393051c5069fff67856472f9b9f94
  • SHA512 336169a11657c10f65c81448df0f15d007cded0f30b05bea55cb49e7de955c5560c3a7c67aae7a082d45fcc48ae4ee2927fd2d82f25c57c7edc9c9863403ca66
  • SSDEEP 49152:Dlu7z5KYGZMte29mqkdFPRo0A6Yz2mbm1XIoj1W9bPjvhzlYt47Vhl5j5cQYDOO/:Dl
  • TLSH
    T120468562684F23CFD49B0536FB12E0B2956F9873E78E52D9848B503E39D90EE540EB74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerspywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2