acrstealer | 206260eee16c40b505efa0b70310863a14266a4f10c18e301478c1e6c5bf4ddf

Sharing

Copy URL Twitter E-mail

General

Target
INSTALLER.zip
Size 39.2MB
Sample260912-slyfcszapc
SHA256 206260eee16c40b505efa0b70310863a14266a4f10c18e301478c1e6c5bf4ddf
MD5 fdfa2d46c335bd2749acdfcbd8a3b338
SHA1 9f3c952c171c1738db048592f0368a671387a08c
SHA512 d486ae00cafb4ffde9925793e32dbb8cee12e67efc5e19beb091fb7d1d01381bb7e65e2923a31357d6543fe8d1a42627822f8b9c7472f2fdb613309f075e2373
SSDEEP 786432:xUPpNFxV4AQDsF6i8lurvgiB++M1EqWiLa1zqqrOe1qEWiL65:epr+AFElur0+M1+9rr1u/
TLSH
T1AB97332615D54FD1D95E0A39A0E30342236CBE0E449693CBC77DC35F3EB22B49F15AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

sync.canyonmere.cc

Decoy

cdnjs.cloudflare.com

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
01a034f4-51c1-7e0e-a650-137d7032a680

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Targets

- Target
  AcGenral.dll
- Size 13.1MB
- SHA256 94402f09c71aafc5631ea1d0b55c87de39e1507e3addd7da399ce2f6ff2f3451
- MD5 6180e06e0cb977429d9013234dae0111
- SHA1 88ba195a0a3a1e74ddd5a7a6d770113712b343b7
- SHA512 347e9dec0f24ffc27efa14f062411099e4ccc858f0f9d2b9c78eaeab4cf46396bdb2d8b45cea87a5a999c4ee8d142d32168dcf5c4bf0d55ea5be614e61540913
- SSDEEP 49152:4q5wL6JSsltF1tXDvNYzniB9MUEbZj0sTG2mp76XkJ1FWm+IWjnyeziuMkN2Cw6G:4qGLejDOzns
- TLSH
  T1A0D67D20EB80110A9E931FABECF205A3563CE511531ED19AE89D074D1AD74DCD37ABBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Setup.exe
- Size 94KB
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
- MD5 eba77a34e9b8aa78fce520d1431fc68b
- SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
- SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
- SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
- TLSH
  T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery acrstealer spyware stealer
- Detects ACRStealer V4.x
- Family: ACR stealer,GrMsk
  ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
  stealer acrstealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2 behavioral3
- Target
  bin/QtCore4.dll
- Size 1004KB
- SHA256 2bb0d6fff88427e34c7d0d29e97443fe9826c42ce2aa0269f024b23d9e9ea22a
- MD5 96213755b33c017492437ca934987207
- SHA1 8e6f7c5d3ae9a0ea783e8ecb6bb69f827b903932
- SHA512 dad2bff4d673efc34ceac3c4fcb3f67eb922302e67658e3ee9d6cd17ca31b8785b4745840f2f1030106b5184cd12140b3e7872a3e91d16e657e9ecbb3de8517a
- SSDEEP 24576:eNeIBNL823deUvLNJngNphsq7OdyVgTsiovRMSN:AeIlHb4pPihTvoi
- TLSH
  T1DA259E1276B318B7C4B2C3700D652F1A46BBC9334152CB9B739EBC1069762E676EB306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  bin/QtGui4.dll
- Size 3.8MB
- SHA256 4e17c4962c29061c66300d5acf19e8fda28609f1eb69df8d2ffa2b69687895cd
- MD5 003b7f5efa14c014ef8c66986fece1f6
- SHA1 7eef91a39f9326f641d73374de26b41daea96d0f
- SHA512 013479b4a930a6edad2379515022e06a845a049ec9551bef018a837bbb3ee6567267b1290af37cedbf5f76cabed9c1308e9203acd67fdb065f41d3f9d3856e8e
- SSDEEP 49152:NG8tOCKR4CZO8VsDwRY0HDtURZO5paM3sLK0k8xMNmuvNGf6hAhTrOjXhWw49:rKR4CZO8VYZjRZO5pf6K0cQfB5rOjXh
- TLSH
  T1AD06AF23B38700F3D6A7D3F01D4E232ACAFAE76545658747839C8D4166A2692F96F307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  bin/diskpl.exe
- Size 712KB
- SHA256 32e08e6f5d643c02c2ad900a7ead09cefe6be5d9bc6f734e6bbe188445de9393
- MD5 b0eb0f04d143007679108f66fb14bba7
- SHA1 604473421cff4f1d2da9dd6d3b06760fcf4f6fa5
- SHA512 8d88e88ee8d3366ae391d1ecd82c66709805b681c57c1fb5f7e90cf1d77b0965f4b37e3d672b9fc49d2fc120f74b7745aec7fe0178be07b5831361eb53cd243f
- SSDEEP 12288:/3/U/WVOiPsgRhQfwLFem6FktB0s7iPkVigeBi:/3/cktB0s72kVeg
- TLSH
  T10BF45B11B16F63E7EA84F2F10E1CA77B09B5A154AB25CF43D399FF12406D2607D2B21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  bin/imageformats/qgif4.dll
- Size 28KB
- SHA256 fe8b67e424dafce5b6a2b8334d22f3b24126b957fce1d4c6e911b3f564161ba1
- MD5 89ef1053c08539e7157ce24246a59200
- SHA1 b0c6a7dcd2a425df0d23c1c899a2b397ae1c6591
- SHA512 598dabf602c8496e029d0084156f8dc6f18e2b8d326e994962c1950336b164ff4de41ff1237f9586cf666aed833bc6fdbb0a0f89dde2e405478ef8e3cc44cb70
- SSDEEP 192:3cMgHhWr3VGrvttv+/gwKi2RnvR0Dwf0wOOSwzu24IzvGfrWFrwyY:u4rM+no1p085BuwvGfrW9
- TLSH
  T1E0D21A13F63A84F3E22213B5179B125BE37BA16152C68E5B4B43EC182C7D7667E3170A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  bin/imageformats/qjpeg4.dll
- Size 100KB
- SHA256 bc82e8fe15670ada26d4f684d3cbe5f33901284bc366047722de8b7f62996a46
- MD5 3d20fa8dd933c76ed5cc48544219099f
- SHA1 1e28cf769f723404323f76e8ee7423c1bb679e5e
- SHA512 c976ae78439ef224715e354aafaa23ff15bfb74e5968cb9424c12af6f69dca45d68dde6a319651fd39fa2c517017e19cf8a19a93d765e6d30090a42fab1cdb2f
- SSDEEP 1536:krld5tFM0AfS/nrr+YRnudgjgMnzs3lviZ1pX0582VeQRgphkWVg:yv5nrAq/nrrjjgMzKYCiugvkWVg
- TLSH
  T19FA3AE72F2610069C0A30375525FAF2E9EBE6373045DBB6707B869202B75AB5FF60285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  bin/imageformats/qmng4.dll
- Size 188KB
- SHA256 06f966e4f069d797dd0e629f7874fd8f11d9accedc9f5e68d4d81f3cee023a29
- MD5 d5ae01409e4f9e54b39ad6ea1d8c2dd4
- SHA1 fc4c114f9535554ac4bb275bd9190ce30e41a4c8
- SHA512 a4967616641d8e284e410c506c5f2e52e8ae83f207fc1503cc914a3b19a2f0de5a51813ae727530ad1c817673fa2f0bef2ba44f0347b198239d68c1220ccaea1
- SSDEEP 3072:Qy6GDeglXZAraG/kWVtKrV5swxQBhraCt7UXwQuT4npqp2dMHuf79TBP8UDXyWys:brZUkW/KrV5xQBhraCt4XwlT4npqp2d7
- TLSH
  T11D148D9991EA6CB0D8C9067EB05B375EFFBD763A46455A5323E01ED0BEA02B0E50431E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  bin/imageformats/qsvg4.dll
- Size 24KB
- SHA256 6e31a5592490e39c46bf379dceabe57219a246510367b8cff52f080ad5ac8dd9
- MD5 6c73095e7a27dd9e45e15e5e9a852aa7
- SHA1 39d17a2d5d6026d3152a63c3cb0082044e2b8381
- SHA512 d1b8eba59bd21289cdac76f09a1a7d8de674cc514ad109edddc1ff0a0f5288be587d9e49dcc2df27fb99381ef48a342e6347b0dd94da8bd21386933ff92bb80a
- SSDEEP 192:smfEg61syvkhCRCTmQT4NdQeR5irmWP4P:ogysyvkYdRR5irmWP
- TLSH
  T19DB2D732C3EA94DAD3B253F41B69436BB5BAE06007E7A2538B13D9503DA8365FD51306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  bin/imageformats/qtiff4.dll
- Size 244KB
- SHA256 7ca868368b685167d90316b7f8c6b5f7c90eef8c08f3176bfa23d0ce7a298692
- MD5 011e3fb1a74e1654970b530c9f3585f1
- SHA1 cd526f69c7a88331c1d25c38d3db3de60b055b15
- SHA512 329f31e761cd92b77c1581b7e1f5b0d15464c1a11e24afaeb1d0b6cafbbbe00492f793569ff1a906e39b643d46a5002ba40a65a267a98ee92f30e3106eb62818
- SSDEEP 3072:jO21C3R2Ijr8jgtaxYzsyUdo0/n5xMTAIsaXKtCPlXKiXJ:y21KNjwjgtauzsjdoywTAIsarP4i
- TLSH
  T15434E904CED18D6BD87442366AEBC661B677E48A7F12DB07E70C70303A517916A8B4FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  bin/libmng.dll
- Size 648KB
- SHA256 3dfd6c5230a0b74622c8077ead5fa4736b7655b124f91949a1ad60cc8bc4d701
- MD5 86f3f9bbc3888293cc150fefea0790ee
- SHA1 5c873a1d18e043a12af51a203790985e8d2d8a54
- SHA512 b5ba723d6e567f4a767cb4937e6d3ba0aacecb4a40dc3be4e1d5f05ad6517053e7d36fec0af14bb4b214c26cebbffa13a4fac90fa28a154f9c9076f3dcee9e55
- SSDEEP 12288:+hb4aZ7lXysBpc6MxFLOIzVPKfqDPS6oPdOY/:YbnBq6MzL9VwCStN
- TLSH
  T1DCE45C21B6AF02F7DA4DF2F5061C737B0A7AB2949728CB039359FF1A142D2527937606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  bin/libmon.dll
- Size 976KB
- SHA256 d6cab05386bdc63e96316b519715b1174143bee3de84cf936769d17b7b115f55
- MD5 f17da8332bc3ae1e892e7942e756ff46
- SHA1 811aff7e3f4971092db1d21be3eccedb7c5aa41a
- SHA512 bd2a9305d63077e54935289bd8af84e7f7c55f2ff43d0a2bc4116a32e072647c52481c8d489b90370089c83d316448e2b8d50ca2958f149c71994b3774bdd4ae
- SSDEEP 12288:V804/9FbGVcpMPuMgJ5e0GnQKNCbQNKrO9/OY6nkPiHVFI:m04/9VGV6MgJ5lfKN2q9/OY6pVFI
- TLSH
  T16C259E10FB9A00FADD45B9F2293E37335E74C2469B11CF939329FE65186E2A1B41B11B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  bin/libpal.dll
- Size 1.0MB
- SHA256 106ac038e1b30c7de19100ae9026217a5dec14f14a43f4012aed8fee1eeda858
- MD5 baadffff5cc10c3b62507078f08462ec
- SHA1 056c86d24263d4a219d598c979e815a73fecc731
- SHA512 81e2f38b4fb3834c277a2d0b01f7557951f80c01fa93aaac07839c85d79b9feb16c720139960be5f571e2ce37fb59b5c9ca824b72ae5e84c186bf94fe29befb2
- SSDEEP 12288:k1MCAPPTvftxFSS2yjRHnxFiUHb3YzGOi1Ja51HYB4:k1MCAP7ntxFSSXjRHnxZb3YyOb51Hm4
- TLSH
  T1B3359D40FBC780F6DD8A7AB5296A33374F35920D1215C793E725EEE198A2192DD3D30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  bin/libspg.dll
- Size 3.1MB
- SHA256 1da905d5799176c8044b71ee2e17f27dd731ea70d49eb5a767a077fcfc89b780
- MD5 73d8c7747cfaa926eab24e81af0aa8e7
- SHA1 507bc9fb36b2fb2a704125cb3b9a8e1033da576f
- SHA512 913174da6b0ab726d612cc283723c1fda1a18afb64a0075bcac193448786c68f5934fcf1ea147e16be59609f7882d117d77872f8570a90c6d0830dbcef735b1a
- SSDEEP 49152:QdTWzmEfaf7aiDz3c74njJQPJ4JKL5tD1YV:QdTuaDaKz3c7ujJQ
- TLSH
  T160E55B1A795F20E7F38DB1B60578B6330537A298AF87CB0393D8FD56597A5837826203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  bin/libspp.dll
- Size 2.6MB
- SHA256 4c74aaf581544ba9d7eea9826093f318be0f0375b6ede837e69a102dd2f4838a
- MD5 b9bace4ec8532f067ee5a013cb0365b2
- SHA1 e81ecd2f782439d440705c5c36d0199eac90a464
- SHA512 7554ce6c3f27356bad77fb1d004e7e7ffeb971fc0249905d9e5db98a052cd41070ab97758e29b7b2fa38795bde1962f164471f317c04ab2249fde0d832cb58e2
- SSDEEP 49152:7LfiebXFQZiK6cCfpPk+vQFMplqgegW4:7LfjDFu6cCfpPk+vQFMplqgegW
- TLSH
  T12DC59E12FACA00FBDA48B671265C37374EB5C2495601CBE77738EE351C7E2A1646B21E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  bin/sppinst.exe
- Size 32KB
- SHA256 5ff841292d504e87649137b2bc8f6c3491ad5ddef2cf9a29e802bce117707f73
- MD5 7405664128a2e03f9f0932e484c3fb10
- SHA1 1e62cb3cf58500e13961911411f271f8bb4734f8
- SHA512 0e971a75206f061147461cd3e8e277372610478322fbf59b77b835e67706ad0993c834acdc602e520743b154c26a38bd89e3f1f870aa5b695a9b917dd05ed245
- SSDEEP 384:FEIASq1jNFAOTmjGzz1o1DsWipfQT8DY/G:BAZFAOHzwINi/
- TLSH
  T12FE29602F84712B7C940EE700FAD007F8FB5E6BD6856DA83973DEE2285AC3187457926
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  bin/sppshex.exe
- Size 36KB
- SHA256 08a4a9f379c33238c2e2e4c848dfc72edec8bd157b380de9d07873556cbfa302
- MD5 aa84c9131078a8dbf672e6d39a9fc5a3
- SHA1 db6b56a4159f03e315c5774873ae057a43101867
- SHA512 42d7144d7831011fe55ee73fdd1f4683aa40aaf5c760348b248676c15bfdf7f8b7c70b3e3cc7d5a386353c48e48db8464eb268ff5bf241c5532d94dfddef9272
- SSDEEP 384:6g1aVcL1jNjAbvTmzGZLjLnwRwg11Dj+WZeQQT8DY/G:6gD5ZjALZjLsv+eO/
- TLSH
  T121F2A612B84712B7C940EE700F9940BB9FB9E67D5C56CB83D73CED2285BC219B45392A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ACRStealer V4.x

Family: ACR stealer,GrMsk

Suspicious use of NtCreateUserProcessOtherParentProcess

Reads user/profile data of local email clients

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32