acrstealer: d353d849 — Eighth sibling, module JyUjBKWCTzoLKTp, no static C2

Executive Summary

Eighth confirmed sibling in the ACR Stealer cluster. Go 1.26.2 PE32, Authenticode-signed (CN=me.muz.li / issuer R13), randomized module path JyUjBKWCTzoLKTp, 26 obfuscated main.* functions. No hardcoded C2 strings in static sections — C2 is runtime-decoded via math/rand PRNG seeded from time.Now(), a pattern now dominant in newer siblings. .rsrc icon masquerade is intact (256×256 PNG present). Static-only analysis; CAPE skipped due to no Windows guest.

What It Is

Family attribution: OpenCTI labels acrstealer, exe, urlhaus ^[metadata.json]. No CAPE detonation available ^[dynamic-analysis.md].

How It Works

The binary is a Go static executable with no CGO dependencies. The Go runtime resolves additional Windows APIs at load-time via LoadLibraryExW/GetProcAddress ^[pefile.txt]; the import table lists only kernel32.dll (41 imports). Standard library linkage implies TLS/HTTPS C2 client capability: crypto/tls, net/http, crypto/x509 all present in .rdata strings ^[strings.txt].

Entry point behaviour (radare2 decompile of main.main at 0x0049a570):

1. Allocates a math/rand RNG source via runtime.newobject
2. Seeds the generator with a value derived from the current time (math/rand._rngSource_.Seed) ^[r2:main.main]
3. Calls math/rand._Rand_.Intn(0x320) and math/rand._Rand_.Intn(0x1868f) ^[r2:main.main]
4. Invokes additional randomized main.* functions (26 total, see Decompiled Behaviour)

This PRNG-seeded decode pattern is the family's established C2 resolution mechanism. No plaintext C2 URLs, IPs, or domains are embedded in the binary — they are generated or decoded at runtime. The absence of hardcoded C2 is consistent with siblings 624f52cc and f93d8d79.

Decompiled Behaviour

Entry point: entry0 at 0x0047efa0 → jumps to _rt0_386 at 0x47cfd0, standard Go runtime bootstrap ^[r2:entry0].

Notable functions (radare2 symbols):

• sym.main.main (0x0049a570) — entry logic, PRNG seeding, orchestrates stealer workflow ^[r2:main.main]
• sym.main.koadmcfwdblr (0x00496350) — first randomized helper
• sym.main.dunzswvabggoy (0x00496470) — second randomized helper
• 24 additional main.* functions with randomized names (full list: main.ypzaagu, main.qvovafgcetg, main.fjwvwx, main.vjntupjxsag, main.Jbeqmup, main.bfwolzqr, main.jbapqofoiltz, main.alodyzp, main.mokfeucdfw, main.qptaixf, main.vlftorcor, main.scegsas, main.dwthxescnnul, main.eiumusxg, main.bmksjaqqbftifbm, main.cisfyoshzz, main.eexyrhzmuszqd, main.siglro, main.qrhwnyohmc, main.uifrwmkuekivda, main.fllovneibwfj, main.kxdxfkup) ^[r2:sym.go.main.*]

Control flow: No external packer or VM — the obfuscation is entirely compile-time (-trimpath, randomized module path, randomized function names). The .text section entropy of 6.19 confirms no packing ^[pefile.txt:92].

Anti-analysis: Minimal. No debug checks, no VM detection, no anti-disassembly tricks. The binary relies on the Go runtime's complexity and randomized symbol names to slow static analysis. The null PE timestamp (0x0) is a standard stripped-timestamp artefact, not a time-bomb.

C2 Infrastructure

Static C2: None observed. No hardcoded IP, domain, URL, or mutex name is present in .text, .rdata, or .data sections. This is consistent with the runtime-decoded C2 pattern established in siblings 624f52cc and f93d8d79.

Inferred C2 mechanism: PRNG-seeded string decoding. The main.main function seeds a math/rand generator with the current time, then draws random integers. Previous siblings used this pattern to decode C2 strings or select from a hardcoded pool of endpoints. The exact decode algorithm is not recoverable from static analysis alone.

Previous sibling C2s (for cluster context):

• 5.252.155.72 / laserlogdnsop.icu — siblings 1-3
• hertzfigblob.icu — sibling 1bfebf79
• None static — siblings f93d8d79, 624f52cc, and this sample

Interesting Tidbits

• Eighth sibling, new module path: JyUjBKWCTzoLKTp has not been observed in any prior sibling. The family now spans 8 distinct module paths.
• Certificate chain unchanged: CN=me.muz.li, issuer R13, validity 2026-05-07 to 2026-08-05. Same template as siblings 3-7. The certificate is self-signed or issued by a low-reputation CA (R13 is not a recognized public CA).
• .rsrc icons intact: Unlike sibling f93d8d79 (stripped .rsrc), this sample retains the 256×256 PNG icon used for social-engineering masquerade ^[binwalk.txt:10].
• 26 randomized main.* functions: Moderate count. Sibling 624f52cc had 32; 9d2ca3 cluster had 39; vidar had 155. The count varies per build.
• Null PE timestamp: All timestamps in the PE header and directories are 0x0 ^[pefile.txt:34] ^[pefile.txt:274]. This is consistent with Go's default when -trimpath is used and no explicit linker timestamp is set.
• capa failed: The capa tool failed due to missing signatures directory ^[capa.txt]. No capability hits are available.

How To Mess With It (Homelab Replication)

Build a comparable Go binary to understand the toolchain fingerprint:

# Install Go 1.26.2 (or latest)
go version  # verify

# Create a randomized module path
mkdir -p /tmp/stub/JyUjBKWCTzoLKTp
cd /tmp/stub/JyUjBKWCTzoLKTp
go mod init JyUjBKWCTzoLKTp

# Write a minimal main.go with randomized function names
cat > main.go << 'EOF'
package main

import (
    "fmt"
    "math/rand"
    "time"
)

func koadmcfwdblr() { fmt.Println("stub") }
func dunzswvabggoy() { fmt.Println("stub") }

func main() {
    r := rand.New(rand.NewSource(time.Now().UnixNano()))
    r.Intn(800)
    r.Intn(0x1868f)
    koadmcfwdblr()
    dunzswvabggoy()
}
EOF

# Build with matching flags
GOOS=windows GOARCH=386 CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o stub.exe

# Verify fingerprint
file stub.exe                    # PE32 executable
strings stub.exe | grep go1.26   # build version
strings stub.exe | grep JyUj     # module path

Verification: Compare strings output to the original's strings.txt. You should see go1.26.2, path\tJyUjBKWCTzoLKTp, CGO_ENABLED=0, and -trimpath=true.

Deployable Signatures

YARA Rule

rule ACRStealer_Go126_Signed_PE32_v8
{
    meta:
        description = "ACR Stealer v8 — Go 1.26.2 signed PE32 with randomized module path and runtime PRNG C2 decoding"
        author = "PacketPursuit"
        date = "2026-07-09"
        hash = "d353d849b0a656ad633b677bd3413c5da9975bfac34c90927b948ee1289f058c"
        family = "acrstealer"
    strings:
        $go_build = "go1.26.2" ascii wide
        $trimpath = "build\t-trimpath=true" ascii
        $cgo_off  = "build\tCGO_ENABLED=0" ascii
        $mod_path = /path\t[A-Za-z0-9]{12,20}\r?\n/ ascii
        $build_id = /Go build ID: "[A-Za-z0-9_\/\-]{40,120}"/ ascii
        $cert_cn  = "me.muz.li" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $go_build and
        $trimpath and
        $cgo_off and
        #mod_path >= 1 and
        pe.number_of_signatures > 0 and
        pe.number_of_resources >= 2
}

Behavioral Fingerprint

A signed PE32 executable compiled with Go 1.26 (GOARCH=386, CGO_ENABLED=0, -trimpath=true) whose module path is a random alphanumeric string of 12–20 characters. On execution, it resolves kernel32 APIs via LoadLibraryExW/GetProcAddress, allocates a math/rand RNG source, seeds it with the current time, draws two pseudo-random integers (Intn(800) and Intn(0x1868f)), then invokes a series of obfuscated main.* functions. No hardcoded C2 strings are present in the binary; C2 endpoints are runtime-decoded. The .rsrc section contains one or more PNG icons (including 256×256) used for application masquerade.

IOC List

Detection Signatures

References

• acrstealer — Family entity page
• golang-stealer-build-pattern — Cross-family build concept
• OpenCTI artifact ID: 82708a3a-c958-4c4a-b94b-9cd8f7651580

Provenance

Analysis derived from:

• file.txt — file(1) output
• pefile.txt — pefile Python library dump
• strings.txt — strings(1) output
• binwalk.txt — binwalk signature scan
• rabin2-info.txt — radare2 rabin2 -I output
• triage.json — triage pipeline metadata
• metadata.json — OpenCTI enrichment
• dynamic-analysis.md — CAPE status (skipped, no Windows guest)
• capa.txt — capa error (missing signatures directory)
• Radare2 live analysis (file opened, aa analysis, s main.main, pdc) — radare2 5.9.8