Extracted

• • Target
    ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll
  • Size 3.5MB
  • SHA256 ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae
  • MD5 fcbc8cdae4a0c5cc0bd5e95b21987a51
  • SHA1 253f5e4ca4df454ed4d04fde7a3277a6b189a860
  • SHA512 e0ec0ce54651b2cfd56ce427d27903e51ab28786433c3eda865ab6ab22470519d3d5b5b35e44ed117451758c064c4452c9a6f7b87e1699dded18ce38c5efa604
  • SSDEEP 49152:H9WJUK/poxbEIscEOwWDgudxkwkDx2t8dKvUsZw7ilXsZWcalJHm0HPa4HrG9ewb:W
  • TLSH
    T10506D6662D52782BD3FD32BC148B2F17B8BD7D6365F41CAA419409A478D2C79C2CBD0A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerpersistencespywarestealer

  • Detects ACRStealer V4.x

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2