AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. ネットワーク接続とSSL/TLS設定 Process Hackerのメモリ分析により、AcrStealerはC2サーバーとの安全な通信にSSL/TLSを使用してネットワーク接続を確立することが明らかになりました。 主な観察事項: SslClientCert – 認証にクライアント証明書を使用（検出を回避）。 EnabledProtocols – サポートされているTLSプロトコルを指定（例：TLS 1.2、1.3）。 EnabledRevertToSelfClientCertificate – 自己署名証明書へのフォールバックを許可。 Connection / DataChunks...

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

TrendAI™ Research analyzed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain...

Hackers Use Google Docs and Steam to Spread ACRStealer Infostealer

A new information-stealing malware, ACRStealer, is leveraging legitimate platforms like Google Docs and Steam to carry out its…...

Google Docs used by infostealer ACRStealer as part of attack

An infostealer known as ACRStealer is using legitimate platforms like Google Docs and Steam as part of an attack, according to researchers. ACRStealer is often distributed via the tried and tested method of download as cracks and keygens, which are used in software piracy. The infostealer has bee...