cloud55filecc (contested → acrstealer): 8bb023f2 — Go 1.25.4 PE32, quiverquant.com/WE1 cert, five-icon suite

Executive Summary

PE32 executable vibo.exe (4.6 MB) tagged by OpenCTI as cloud55file-cc. Static analysis resolves it to the acrstealer cluster: Go 1.25.4, self-signed Authenticode CN=quiverquant.com / issuer WE1, randomized module path LkYepTgpfGoTJPv, 11 randomized main.* functions, five-icon .rsrc suite, and no static C2. This is the forty-seventh confirmed sibling in the ACR cluster and the eighteenth confirmed sample on the quiverquant.com/WE1 cert chain. The cloud55filecc label remains contested; all technical evidence points to ACR. ^[/intel/analyses/8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce.html]

What It Is

Build / RE

Toolchain: Go 1.25.4 with -trimpath, producing a standard statically-linked PE32 with no external CRT. The Go build ID BVrnoOrAVVaYdOlHLAPK/cOUBfNGrV1efNoya0Gh2/IGI22km3b5jkeMNXyJTd/7zDSX1Qeu_ZisY8QI7oe is present in .rdata ^[strings.txt:8]. No UPX or external packer — entropy in .text is within normal Go ranges. ^[pefile.txt]

Signing: Authenticode certificate embedded at IMAGE_DIRECTORY_ENTRY_SECURITY (offset 0x46DA08, size ~2,200 bytes). Parsed via PKCS#7: CN=quiverquant.com, issuer=WE1, valid May 9 21:13:51 2026 GMT through Aug 7 22:13:46 2026 GMT, serial 10F69E50B05B14F30EBF139155B65887. This is the eighteenth confirmed sample on the quiverquant.com/WE1 self-signed cert chain within the ACR cluster. ^[binwalk.txt] ^[pefile.txt]

Obfuscation: Standard Go anti-static measures for this cluster:

• Randomized module path (LkYepTgpfGoTJPv) ^[strings.txt:1663]
• 11 randomized main.* function names: Qhpcor, qrbmol, Vedkdqj, Lhjccpry, Ntyymvng, ikwkliup, Fjwazmkdp, Tepqbcamj, qhlzdghuu, Guvyzgjehoyg, Mhbsxbcyptvlxv ^[strings.txt:870–1326]
• No custom PE parser or multi-pass byte-transform decoder (light baseline build)

Resources: .rsrc section contains a five-icon suite (16×16, 32×32, 64×64, 128×128, 256×256 PNG) ^[binwalk.txt]. This is the full icon set observed on earlier siblings 1cf857a9, 725dc07c, and b3968863 on this cert chain.

Imports: Minimal IAT — only kernel32.dll imports (standard Go runtime surface). No wininet, ws2_32, or crypt32 in the static import table; all network/crypto is resolved through Go's statically-linked runtime. ^[pefile.txt:273–327]

Anti-analysis: None observed statically. No PEB-walking, no debug checks, no VM detection strings. The null PE timestamp and randomized names are the only anti-static measures.

Deploy / ATT&CK

Execution: Inferred seed-PRNG C2 URL decoding at runtime, identical to the pattern documented for the ACR cluster (see prng-seeded-c2-url-decoding). No static C2 strings, IPs, or domains recovered. ^[strings.txt]

Network: crypto/tls and net/http linkage confirmed via runtime strings ^[strings.txt:1585], but no specific endpoints. Family behaviour from prior siblings implies HTTPS POST exfil to runtime-decoded domains.

Collection: Inferred browser credential stores and cryptocurrency wallet targeting (family pattern). No static confirmation of wallet names or browser paths in this sample.

Persistence: None observed statically. ACR siblings have used no persistent technique (pure drop-and-run) or Task Scheduler in rare variants.

ATT&CK mapping (static inference, no dynamic execution):

• T1071.001 — Application Layer Protocol: Web (inferred from net/http + crypto/tls runtime linkage)
• T1027 — Obfuscated Files or Information (randomized module paths and function names)
• T1620 — Reflective Code Loading (Go statically-linked binary with no disk-resident dependencies)

Attribution: ACR stealer cluster. OpenCTI preliminary label cloud55file-cc is contested; same label also appears on siblings b3968863, 1b98937b, ba1af858, 58eda486, a02296ce, and c0a47856 which all resolved to ACR. No independent technical fingerprint separates cloud55filecc from the ACR cluster.

C2 Infrastructure

None recovered statically. The binary contains no hardcoded URLs, IPs, domains, or mutex names. C2 is fully runtime-decoded via the family's PRNG-seeded string-decoding routine. This is consistent with the "no static C2" pattern observed on seventeen prior siblings on the quiverquant.com/WE1 cert chain.

Interesting Tidbits

• Five-icon suite variant: This sample restores the full five-icon .rsrc suite seen on the earliest siblings of the quiverquant.com/WE1 chain (1cf857a9, 725dc07c), contrasting with the two-icon suite of 1b98937b and the stripped .rsrc of c69b14a0. Suggests a builder "icon count" toggle. ^[binwalk.txt]
• Smallest function-name count on this chain: 11 randomized main.* functions ties the smallest count observed on this cert chain (siblings 94cf86f6, 43998b11, and 1b98937b also have 11). The cluster ranges from 11 to 92. ^[strings.txt:870]
• Standard baseline build: No custom PE parser, no multi-pass decoder, no .rsrc stripping — a light, mid-config build from what appears to be a builder kit with multiple toggles.
• Certificate validity window: May 9 → Aug 7 2026 is the same 90-day window as the rest of the quiverquant.com/WE1 chain, consistent with automated cert generation in the builder.

Deployable Signatures

YARA Rule

rule ACR_Stealer_Go1254_Quiverquant_WE1 : infostealer golang {
    meta:
        description = "ACR stealer Go 1.25.4 PE32 on quiverquant.com/WE1 cert chain"
        author = "PacketPursuit"
        reference = "8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce"
    strings:
        $go_build = "go1.25.4" ascii wide
        $mod_path = "path\tLkYepTgpfGoTJPv" ascii
        $build_id = "Go build ID: \"BVrnoOrAVVaYdOlHLAPK" ascii
        $cert_cn = "quiverquant.com" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize < 6MB and
        all of them
}

Static-only analysis. CAPE skipped — no Windows guest available.