ACR (Infostealer) – Malware

Overview

The ACR Stealer is a potent piece of malware that has rapidly gained notoriety in the cybersecurity realm due to its ability to harvest sensitive information from compromised systems. As organizations increasingly depend on digital platforms for their operations, the threat posed by data-stealing malware like ACR Stealer becomes ever more significant. This article explores the operational mechanisms of ACR Stealer, the types of data it targets, and the broader implications for cybersecurity.

Targets

Information Individuals

How they operate

Infection and Initial Access

The initial delivery of ACR Stealer typically occurs through phishing campaigns. Attackers employ various tactics, such as spear phishing emails, which contain malicious attachments designed to lure victims into opening them. These attachments often masquerade as legitimate documents, leveraging social engineering techniques to bypass user skepticism. Once a victim downloads and opens the file, they are prompted to enable macros, a step that is crucial for the malware’s execution. This user interaction is an essential part of the malware’s lifecycle, as it depends on victims’ compliance to initiate the infection.

Execution and Persistence

Upon successful execution, ACR Stealer utilizes scripting techniques to deploy its payload effectively. The malware is designed to establish persistence on the infected system by modifying registry keys or adding itself to startup folders. This ensures that the malware runs automatically each time the system boots, allowing it to maintain a foothold on the device. Additionally, it may create scheduled tasks to execute its payload at specified intervals, thereby ensuring its longevity on the system.

Credential Access and Data Collection

A critical function of ACR Stealer is its ability to extract sensitive data from the infected environment. It employs credential dumping techniques to harvest stored login credentials from various applications, particularly web browsers like Google Chrome, Mozilla Firefox, and Microsoft Edge. By accessing browser databases, ACR Stealer can retrieve usernames and passwords that users have saved, significantly undermining their security. The malware also conducts automated collection of documents, scanning the file system for sensitive files that match certain extensions, including .docx, .xlsx, .pdf, and .txt. This capability allows it to amass a trove of potentially valuable information, which can be exploited for various malicious purposes, including identity theft and financial fraud.

Exfiltration and Command & Control Communication

Once ACR Stealer has collected the targeted data, it initiates the exfiltration process. This typically occurs over a Command and Control (C2) channel, using encrypted communication methods to transmit the stolen information back to the attackers. By employing application layer protocols, the malware can obscure its traffic, making detection more challenging for cybersecurity defenses. In some instances, ACR Stealer utilizes Domain Generation Algorithms (DGAs) to establish C2 communication, dynamically generating domain names to evade detection by security tools that may block known malicious domains. This ability to adapt its communication strategy enhances the malware’s effectiveness and persistence in the target environment.

Conclusion

The ACR Stealer malware exemplifies the evolving tactics employed by cybercriminals to exploit vulnerabilities in user behavior and system defenses. Its ability to infiltrate systems through phishing, establish persistence, collect sensitive data, and exfiltrate information underscores the need for robust cybersecurity measures. Organizations and individuals must remain vigilant against these threats, employing comprehensive security strategies, including user education, multi-factor authentication, and advanced threat detection technologies, to mitigate the risks posed by malware like ACR Stealer. As cyber threats continue to evolve, understanding the technical operation of these malware variants becomes crucial in safeguarding sensitive information and maintaining the integrity of digital environments.

MITRE Tactics and Techniques

Initial Access:

Phishing (T1566): ACR Stealer is often delivered through phishing emails that trick users into downloading malicious files. Spear Phishing Attachment (T1566.001): Specific attachments containing the malware are sent to targeted individuals or organizations.

Execution:

User Execution (T1204): The malware requires user interaction to execute, often relying on users enabling macros or running malicious executables. Scripting (T1064): Malicious scripts may be used to facilitate the execution of the malware payload.

Persistence:

Registry Run Keys / Startup Folder (T1547.001): ACR Stealer may modify registry keys or add itself to startup folders to ensure it runs at system boot. Scheduled Task (T1053): The malware can create scheduled tasks to maintain persistence on the system.

Credential Access:

Credential Dumping (T1003): ACR Stealer targets stored credentials from web browsers and applications. Web Browsers (T1555.002): It specifically extracts login credentials saved in popular web browsers.

Collection:

Data from Information Repositories (T1213): The malware collects sensitive documents and files from the infected system. Automated Collection (T1119): ACR Stealer can automate the collection of sensitive information, such as emails and financial data.

Exfiltration:

Exfiltration Over Command and Control Channel (T1041): The stolen data is sent back to the attackers through encrypted communication with a Command and Control (C2) server. Exfiltration Over Web Service (T1041): It may use various web services to transmit the collected data.

Command and Control:

Application Layer Protocol (T1071): ACR Stealer uses standard protocols for communication with its C2 server, making it harder to detect. Domain Generation Algorithms (T1483): It may employ techniques to generate domains for C2 communications to evade detection.  

References:

• Exploiting CVE-2024-21412: A Stealer Campaign Unleashed