Extracted

• • Target
    20d37Eb6-6b-7
  • Size 79KB
  • SHA256 8ebe078141da5fa2e246e82cdc1335391b74758181500d2314248fb0cf7ca9f7
  • MD5 da22c9712b9202bd919687d49bcf2f78
  • SHA1 8099d70da6d7bb9f66cdcfdf751b5abd7a117657
  • SHA512 92df489bc73bb0606127874017d6ba80463d0b04c0ed4a012cf3ae995aa7db6a81184fe7628f7e47e8a5ecdf9ff9aa3206508121c4f98700929785d81b077550
  • SSDEEP 1536:njpiYzbWMH2o5aH1VEmPiqAT6qpB6nQ1LxAZrnqL1dvPB/G:nliuWMHD5aH1VeqAeqf6nU1AhWJu
  • TLSH
    T17F835F017E8096F0155EECB36F8A689A2FC8B033E39A4C6C7ACF4594FB476B94594D34
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionacrstealerpersistenceprivilege_escalationspywarestealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2