AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. Network Connections & SSL/TLS Configuration

Process Hacker memory analysis reveals that AcrStealer establishes network connections using SSL/TLS for secure communication with its C2 server.

Key Observations:

• SslClientCert – Uses client certificates for authentication (evades detection).
• EnabledProtocols – Specifies supported TLS protocols (e.g., TLS 1.2, 1.3).
• EnabledRevertToSelfClientCertificate – Allows fallback to self-signed certificates.
• Connection / DataChunks – Indicates active data transmission.
• Available – Ready-to-send data buffer.

Why This Matters:

• Secure Communication: SSL/TLS encryption hides the stolen data.
• Evasion: Certificate-based authentication makes traffic look legitimate.
• Data Exfiltration: DataChunks suggest large amounts of stolen data are being sent.

Visual Reference:

Process Hacker view showing SSL/TLS configuration (SslClientCert, EnabledProtocols) and network activity.

2. Custom Network Protocol – Task.Protocol

Binary Ninja analysis of the extracted .bin file reveals that AcrStealer uses a custom network protocol for C2 communication, built around a Task.Protocol structure.

Key Components Observed:

• Task.Protocol.SendData – Sends data to the C2 server.
• Task.Protocol.ReceiveData – Receives data from the C2 server.
• Task.Protocol.Configuration – Stores protocol configuration.
• Task.Protocol.CancelHandle – Cancels ongoing operations.
• CreateProtocolHandle – Creates a protocol handle for communication.
• CloseProtocolHandle – Closes the protocol handle.

Protocol Keywords:

• CONNECT – Establishes a connection.
• SEND – Sends data (exfiltration).
• RECEIVE – Receives commands.
• CLOSE – Closes the connection.
• GLOBAL – Global configuration.
• CONFIGURATION – Protocol settings.

Why This Matters:

• Custom Protocol: Using a custom protocol makes detection harder.
• Command-Based: The protocol supports multiple commands (send, receive, close).
• Data Exfiltration: SEND commands are used to exfiltrate stolen data.

Visual Reference:

Binary Ninja view showing the Task.Protocol structure and protocol keywords (CONNECT, SEND, RECEIVE).

3. Browser & Network Credential Theft

Process Hacker memory analysis reveals that AcrStealer targets browser data and network credentials for theft.

Key Strings Observed:

• BrowserQueryEnabledDomains – Queries enabled domains in the browser.
• BrowserQueryOtherDomains – Queries other domains (likely for cookie theft).
• BrowserResetStatistics – Resets browser statistics (evasion).
• BrowserRefresh – Refreshes browser data (to capture new credentials).
• NetworkAddress – Captures network adapter information.
• NetChannelSet – Manages network channels.
• NetDNSHostName – Captures DNS hostname.
• NTGetLogonControl – Queries logon control (credential theft).

Why This Matters:

• Credential Theft: The malware steals saved passwords and cookies.
• Network Data: Captures network configuration and DNS settings.
• Evasion: Resetting browser statistics helps avoid detection.

Visual Reference:

Process Hacker view showing browser and network credential theft strings.

4. Browser & Network Data Exfiltration (Binary Ninja)

Binary Ninja analysis of the extracted .bin file reveals the actual code responsible for stealing browser and network credentials.

Key Functions Observed:

• BrowserQueryEnabledDomains – Queries enabled browser domains.
• BrowserQueryOtherDomains – Queries other domains (cookie theft).
• BrowserResetStatistics – Resets browser statistics (evasion).
• NetworkAddress – Captures network adapter information.
• NetDNSHostName – Captures DNS hostname.
• NTGetLogonControl – Queries logon control (credential theft).

Why This Matters:

• Data Theft: The code actively steals browser and network credentials.
• Evasion: Resetting statistics helps avoid detection.
• Exfiltration: Stolen data is sent to the C2 server.

Visual Reference:

Binary Ninja view showing browser and network credential theft functions.

5. Process Injection & File Operations

Binary Ninja analysis of the extracted .bin file reveals a comprehensive list of Windows APIs, confirming AcrStealer's ability to perform process injection and file operations.

Key Functions Observed:

• VirtualAllocEx – Allocates memory in a remote process (injection).
• WriteFile – Writes data to a file (exfiltration or logging).
• WaitForSingleObject – Synchronizes threads (injection coordination).
• VirtualProtectEx – Changes memory protection (for injection).
• WaitForDebugEvent – Debugging operations (evasion).

Why This Matters:

• Process Injection: VirtualAllocEx and VirtualProtectEx are used for injection.
• Data Exfiltration: WriteFile writes stolen data to disk or C2.
• Evasion: WaitForDebugEvent helps avoid debugging.

Visual Reference:

Binary Ninja view showing process injection and file operation APIs.

Conclusion

This analysis uncovered AcrStealer, a sophisticated info-stealer that combines advanced network communication, custom protocols, browser credential theft, and process injection.

Key Takeaways:

• Network Communication: Uses SSL/TLS with SslClientCert and custom protocols (Task.Protocol).
• Credential Theft: Targets browser data (BrowserQueryEnabledDomains) and network settings (NetDNSHostName).
• Process Injection: Uses VirtualAllocEx and VirtualProtectEx for injection.
• Data Exfiltration: Uses WriteFile to save stolen data.
• Evasion: Uses WaitForDebugEvent and BrowserResetStatistics to avoid detection.

Detection Recommendations:

• Monitor for VirtualAllocEx and VirtualProtectEx calls.
• Block network traffic to unknown C2 domains.
• Detect BrowserQueryEnabledDomains and NetDNSHostName in memory.
• Monitor WriteFile operations from suspicious processes.

Sample Download

The analyzed AcrStealer sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 AcrStealer Sample on MalwareBazaar

Tools Used: Process Hacker, Binary Ninja, x64dbg