Extracted

• • Target
    b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb.bin.ps1
  • Size 1.4MB
  • SHA256 b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb
  • MD5 f9de04a40b98f268fc2e52cb5ac7d415
  • SHA1 88bd700ffdb40c98956766b2b6052679d244eb21
  • SHA512 515589e1bdbf208b219554d24f700921877fca28db0f24e8525ddb0cb512fdf572ca7ab73f83d8f772ba475ff64db9bc46beaa8f090cb2ceb1818edbc08cc6ce
  • SSDEEP 12288:5xfe7fdtalBmONbTm7d7Ip+Zj9DWVoxYwNikuC541HI+fqmC+eUpi0Up8sbi5swo:0
  • TLSH
    T1D36510523651FD7D029693B16E1646F0A46ACA80CFDF8556F24DCE8CA14EC863AF93C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerstealerpersistencespyware

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2