Extracted

• • Target
    6FC-5B-20-FA-7C
  • Size 233KB
  • SHA256 144057e378c3f1f6eb33dc53e9ab6ebe2855f07e1ea2cdb0841c52383f710203
  • MD5 b06ea25d716001f2dd7ede59044c2e28
  • SHA1 442a4406ee7664be3f3335784494985908116350
  • SHA512 032701eebf926dc00f1fc7834b2f9ea3f780049827c945ac8b523462b413a236e24a1220202886a1b14e5b25b6bc2d97186d2fb7dd1e07736fc8fd881dc38461
  • SSDEEP 6144:a//UQanPFUT9haqowC1JiJUrF2XEU8+j0nVCoNfCvqUs/zbD:xPlNfFU+
  • TLSH
    T1AE34932439C0A665168DDCB72C410C1DAAC9F537E38B684D79CF55C5AF87AB887EC838
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionacrstealerprivilege_escalationspywarestealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2