Extracted

• • Target
    395342804336
  • Size 101KB
  • SHA256 ca31112ea32783cbdf1265608ef8b8b846564024c8a95f0063c1d8f507baa53d
  • MD5 9f8c07782bc0908b908e597d75ebf0bc
  • SHA1 c7f5bf29eaa71ca7ec929dd131ecafc0559f4687
  • SHA512 06bf272b9811a0fca0cc2fd04c2ca113fdf9273ef938b4fb187e7aab845f9e6733a5db0502677838153e09d9d7bacd4eaf8c829c73a175f3a073f12c3d8db427
  • SSDEEP 3072:t/L/6Oy1umMTHaHgNiTErW5FZo5j0gqgVUFX76p1:LyDMTHKgNiTYWPZujwgupmp1
  • TLSH
    T1BAA3951579E3A6E0288DCC7A0D88B9195694A03BC34F4D5C77CE5283AF436FC65F8A35
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionacrstealerpersistencespywarestealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2