acrstealer | 28099633cbac0083a6ec68063e923bfbae4a9efb17368e25f926ff0ea1d8fa95

Sharing

General

Target
Fight_Night_Champion_Free_Download_Archive_free_340124.zip
Size 827.2MB
Sample261015-1s2qcsszbw
SHA256 28099633cbac0083a6ec68063e923bfbae4a9efb17368e25f926ff0ea1d8fa95
MD5 0cdd1e9c93629466374ca988b87b60ba
SHA1 788f5fa45e7b7ea1bcdf67e7c8aff497cb4cbfab
SHA512 0ea23033de7bbb6b6caead27a4c3bb8f9d6eaa3fa8397863934508d1487aa1c052c866f9ccc0c4f0029fccfe1d7b049b81c91f491a282a6001f93dbc31dc75c5
SSDEEP 786432:bZgA/+P7mS054OCT/w38woLq+52HyotOYtX0vXihnPYz5SQH0TZZo5:bZj+zm52OC8wqhSYO6kviVgND0TI
TLSH
T172993322C92DF4D7FF8372B9B8B5C057C776017632DFA2A965A530B48C4A9106F2C91E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\nthub_net35_win32
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

acrstealer

Version

4.4.7-alpha1

imap.dropstream.cc

Decoy

edgesuite.net

Attributes

ddrs
logs.fetchwave.cc
guids
4d0bf37a-3180-4974-a873-a6ec4d4dc9f9

01a10d60-3b38-753b-9223-e8749716a1c5
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Extracted

Family

acrstealer

xor.hex

Targets

- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution acrstealer hijackloader sectoprat loader persistence privilege_escalation rat spyware stealer trojan
- Detects HijackLoader (aka IDAT Loader)
- Detects SectopRAT aka Arechclient2
- Family: ACR stealer,GrMsk
  ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
  stealer acrstealer
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Family: SectopRAT
  SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
- MD5 1090bf4c5495697a1416cd77481cf7d0
- SHA1 94452eed4fa88dcb0a5b3c503a12f3a3b5f23ee8
- SHA512 d205dd98260d033300afe3f2a1c0c06f3bfbf158067fc3290e10ddf6f51eb80b57af56fb0e75a56b82dc3ec49190c5d2c296aa548b64e39b4b004f60a7da89a6
- SSDEEP 6144:CrHQz/GL44uCWgSqTpyGRxyB5EdpmMB6cm+p4HRw0FlA1Qu4P:uudhGDyB5Xa4HRw0FlCQ
- TLSH
  T182947C29B2A448A9D036C038CA174A72DB31B89A0F75F7DF12E5D2692F773D45B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
- MD5 7dde909bd5c7538ac46064741a8da6c0
- SHA1 46b50003be83eab7e0c48ebbd9260b5b021e70eb
- SHA512 a057586a0b566c5470a6508e27764f9662ceaf3b08244c3db3d1e07789e87a30a43f1daad0274a4e3d00b641d3f9f90e9c073a5f7db3fa6d1de7f45c33adc092
- SSDEEP 98304:1DACC5v8sHfvlfkvghk3xlkihzsfFUQOJt6c:CvxkvgfyoiQOR
- TLSH
  T1BD665917F2A281E9C009C135574B9632EB31BC851734BADF2294F6692FB27E06B3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
- MD5 32d079f77a2383e262b4a512931fb120
- SHA1 19902535da3cb79c093f59fd597444a96f143761
- SHA512 b1bca949aa2f7b735a9e8e5d4fed3e698f3ce77edb804ec56d0f66d3faffb9d1f82a55bfdfa5393ea5d64cd8379ce9a59a298fa486d21e4ea5f29340d4cde65b
- SSDEEP 98304:Dt85Qi40yDueXVj4ka+Pjd2wSY6XO7dPlMBLa2THxM/UZpMBAOd3+opm9g0vHF6:B8r4pr4OjZR/XBA63+opm9g0vHF
- TLSH
  T160967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  lib/py3-windows-x86_64/librenpython.dll
- Size 18.2MB
- SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
- MD5 773d30682db91d99eed3b6f6a3591fe6
- SHA1 1be09711350cc40dc258d893ca3c0500c71f92cf
- SHA512 b0893ee4d82b5efe59d8a8ff9690579b106da608d04d161093ce4757e0eea62b5e16d84bbf3a422012801cec3c45a570907bab6d33ae5516facb9e57e3940322
- SSDEEP 196608:Vg6lprLkZark54oIFe/IFtRRcYoB/xEOAoP3i:W6lprLkZarkCoaeQzcYoBxEki
- TLSH
  T146176C4BF05268A8C586D174CE2BEB22BB65784C457279DF329457B03F71BC0AB29F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
- MD5 da67da022bbc1bb9409e3328c1cb64e1
- SHA1 e1fd29f4256d7066f05d113cb8e96e1aebaa38e7
- SHA512 24ba4936ff149f0875b3e4c7e36e80f941130faccd4d6296d68c8af8b0e647c37d0822d477218ab0b3d4b51f24cd1dfa1ace54adfbd175d122036c3a7e787ebf
- SSDEEP 6144:Wo14rtZLc1fPm3YjZxgMOKSjkPDNjYBlplydMofn6cHqq85l:Wo14r/cBPm3Yg8SjoYvplydMofRHqq85
- TLSH
  T1E4744B8BE754DA7ACA1146318CBB0B097337D04067979F5BAB2CD2783D8BBC4DD99608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 068b0c02c881a5d8587a24929e30d8c596305543ae6da5f264f8230a2e45d300
- MD5 c48d5218e5f97b2064c4002d4b30c435
- SHA1 4ac56e31bfb9c5036d60afd6de46a3f1e41f2ec8
- SHA512 3e54fe5174f121528d175ac691c5d36cee63031823c9e09d603d8955312046f57f452e33ffa4863698597849102f52711c3d8738933c07cba12d1f49e611c44c
- SSDEEP 192:rKFj3Az2SjQ0bnUdPIPKPpCxeELcNiTw/dUfYa2GzEfw9vmQ:rKejQ07KPUKueELcNiM/dyDzCw9vF
- TLSH
  T1D762E7069B5524BEDE4AC17FC2771762FAA0B960076219C70371F2650E71FD42B3D8AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 652f72976536214578a6ef848d7359495e02db58846d15ea3a85e90ef1040dc9
- MD5 d11142598cad7ca67caf7606470bbd00
- SHA1 f6d35808803e2c7eaaa85d2f1f756b06495771aa
- SHA512 87b8533b53f87bd8ce0133cd949b0b5393dc3ce02235b374f73be41cea0fa0697da15bee65ec9cf0b8109b549b85659cee38ffb39df763898f584671ff9e2e1a
- SSDEEP 3072:jOC3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:qcQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T115A3F10AAF5616BED921403FEAA70562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
- MD5 8cd16e17df02782c111ef7475bece461
- SHA1 e368b52a96d656c6635df6717bdfad13572ee746
- SHA512 8029576e56a28b9f1975cb28b093c4896bdeee8b7ffe4596bdd9fa4ab7bc277906c7dd6aa7c33375a1fbbc5182ef009e70d7feee1689d4c7ed6510254cbda4f0
- SSDEEP 3072:yOc3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:TqQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T149A3F10AAF5615BED921403FEAA71562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
- MD5 2d68b1f1a4da598a147bc9e375534570
- SHA1 fbf957813a63fd6d7bcc347eb5d4f221ae1e3d62
- SHA512 1c841e412d336bbb1d11d1ce903f1d076af1f9375e74733106ab69e081534948fd1d5ce30949ef139b5e95369fec6badfbfb9f8ca8ba3ef9b54f9a8a3b683709
- SSDEEP 96:Gg1NzUuGd+P2sKNwWwD2j82xnCg8Q/Ks/qN+Bj0ui:L4BRdwD1YCM/KsSN+Bj0ui
- TLSH
  T1BA81860A694549AFFE47F2F2A2C911C14F59C2BD2F94603A365C52443BC3892937B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  lib/python3.9/_bootlocale.pyc
- Size 1KB
- SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
- MD5 b310c1aa498564e607b7323a4c1e5675
- SHA1 9d52941323913140830ccdfdffbcf6916b18d193
- SHA512 1b75a52813a372e7d5fce372b9319c3c8e832754bd18ad6003a8a0f1f106668f01f69c82abd9c0f282439342d406e8a269793ee4139408c5cc9fede8b2486d50
- TLSH
  T12A21024A0B015E4BFD21FBF476C5822446B985790E1FB9591715C27A3D0E25C6E514CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  lib/python3.9/_bootsubprocess.pyc
- Size 2KB
- SHA256 f7070e19a60e1bf2aa5fb590af586328854777554de682ef47a2c2a8580f742c
- MD5 1e73b6724083ab5dd5c41de3fb2bd812
- SHA1 f41b1909e0bf7380553827acfcfa7e8988baf92b
- SHA512 d10667f08268fdd524340073b45bc3705e75b4f47f804dd8ad2fc6b4bb892a4f81e7f195fab08de75f4fbd06c0729afcbce777172858058d8a5675ea1340bcee
- TLSH
  T1C84176DA52B954B3FC61E27F601A12724FB2C539530A5A20251EF9260C4E9D4EC937CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  lib/python3.9/_collections_abc.pyc
- Size 31KB
- SHA256 2cbbd85b65288eafacdd1078886412b4db7028b2426e9e78fc0966ac9c72dca7
- MD5 f1d26a6e70afcc9b37d04638669eca5e
- SHA1 3434a10216fe9effbb8f0fa4c7b38bbd151eb552
- SHA512 9533623e12c78c417b9633e6f63f458178a84bc90a2bdf35cdc55646a79b5b258e353e51faa16673b711acae495e9fe14f114e7d2496bb4fdd4988b7de9a114d
- SSDEEP 768:/GJgavbRORmFHGyiajSVnsximHAC6t2TqBuuUBlMKzR:QbvbMRByiRsximHAC6tNuuUBlMwR
- TLSH
  T157E262C1DEC2EE67F855F2B940760128BB24D2E3B23C8297350DA57E2E07E8499F5D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  lib/python3.9/_compat_pickle.pyc
- Size 5KB
- SHA256 2fd768fcb64fccdffe4706c751481fd12032c49c766d1821d35adf40cab80869
- MD5 911d807e5eeb4e53dcbdc9e23b200288
- SHA1 a5397052715a5ad80ebc50c01b83772e58434624
- SHA512 e41b28e73697423515b9a62f8159f1e523065453cd0bbfa6ef99d91ff34b5acccc08fa127bc771b9bc6b5c19a0f9a699a57995958ef9f28cd3dab1a39b4a4e96
- SSDEEP 96:Mgt2e8lJHvjrCWv4unx3TTdqBjR7ve6n/vNnrO+VCCkf+0QEWuO:12e8lJnCTA3TyG+9rSskO
- TLSH
  T109B1E605730DA6D3FEC6BBF3A7316316E57D008533A1C2958628DA5B0DA8B42DE2537B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  lib/python3.9/_compression.pyc
- Size 4KB
- SHA256 128a541d5bf44dce7df8c2b492a09db68d30895b89261f1822704dc990e16615
- MD5 2925bd5d0f6fd7943ec018515cee6c56
- SHA1 63e3d883f08d1e3bd344866ac22d407276186899
- SHA512 8d0121889c36da90d503fc6b02d531ae1b3c087487a48c83572576ce98012a03dfae31a5e4578ae2b0f55fd2d4821705ca41d76b6441013f47ac20b6647ae2e7
- SSDEEP 96:/GAZIrERfwbPtC0iEKj0KLs3IPrPZNd2ELjNqEcvqiuyng1aN:xk1IjEWCqiu31aN
- TLSH
  T1889172D98705FA9FFD66F3BE8A09777422E0427332886302A509804F7D4D6C59EB79D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  lib/python3.9/_markupbase.pyc
- Size 7KB
- SHA256 bb141259dfbceb260211410bfccd64c523aece349c77133d8c9e2cafb71b2081
- MD5 ba50e7dc5890d22c6a403d27d39c0155
- SHA1 d03b5bdea1deffd34828ec210bdd8f7461ae114b
- SHA512 a345c554ba4dc161be10e6f3f6d7873201d8544ada32fe813e48256958f6e8063a3a07f3d9873d12cc414307d260d4adee342185521eaee58a9e1500b5c00c75
- SSDEEP 192:evE293F7TF+f2cgj9L0+3aYfTdW31NTfDWE06hDorUcP6uitqgT2nV:iE2NF7TF02ci0kaYfTdqjSP6hSUcnlaW
- TLSH
  T130F1B6D959492F8BFC99F3BE940E0A21A436A33D6644C086A514C277BFDC1C19E1F29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32