Extracted

• • Target
    44-077A75-FCE1
  • Size 74KB
  • SHA256 66d875db76987959bae5220b7b3c109d307caf4da8dced8b3be6302385cf43e2
  • MD5 1d2050c31f92396501da8e4724554067
  • SHA1 1eddd201a48f1568f671c8ed9259e8823212760c
  • SHA512 13e4ee3a658f8d5e08c8a1444facd6b5f6a90cff489673ae3421e93ac86d196df247bc2cb230c0bc464a33e9bcf1ea50a33a6d8f7db123eaa13289b7ba15de99
  • SSDEEP 1536:87CERKmTMVPHkK+66JXqhtHyz8cs2zTlqNIACS7u3/IwOheu:87CERZTMVPETpJXqLy/7lSIs7MI1gu
  • TLSH
    T1A57301313A9466D8319EC8B30F49E45C3AD8A223F259AD5FF68DC0CDBE4B2AC55E4435
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerpersistencespywarestealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2