Extracted

• • Target
    SETUP_INSTALLER.zip
  • Size 29.5MB
  • SHA256 c4357e2715ce8a3522dfd83a417f7aaa4871390d70a2ce96561ba8b60a4a5a5e
  • MD5 5a7f56113d14bb8c933d4d1f12ebd09b
  • SHA1 4510e428f13aa5b102bc282ec797a0f964d2630d
  • SHA512 2b8e3dd9e2796b4df354ce690656b07e55a111e4ffc5d87b54cb6242d0a0decd2366a721c1a06718d9589ba30c0084fbd6b40db38e9532a33e8a481d0c36d816
  • SSDEEP 786432:SzVbjVv6vCWflW5tvmuPzIp8M4oEERPXiKS5ai7p34L7fwe:+hcgDzk8M49EwN5ai7Cbwe
  • TLSH
    T10867339EA2F4747E4C06562CB179DBF7DAD9E689D0610C740945C233B2509CF6A32EEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerpersistenceransomwarespywarestealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1