> Family · ACR Stealer_

~/packetpursuit $ cat /intel/families/acrstealer.md

typeentityconfidencehighcreated2026-05-26updated2026-08-19infostealermalware-familygolangsigning

ACR Stealer

Infostealer family written in Go, observed in signed PE32 executables that masquerade as legitimate applications via rich icon resources. First encountered in the PacketPursuit corpus on 2026-05-26. Fifty confirmed siblings have been analysed as of 2026-08-19, spanning Go 1.18.5 through 1.26.2; all share randomized module paths and certificate-chain rotation, with newer builds trending toward runtime-only C2 decoding.

Build Stack

  • Compiler: Go 1.18.5 – 1.26.2 (GOARCH=386, GOOS=windows, CGO_ENABLED=0, -trimpath=true) ^[/intel/analyses/6871848bb724a184e393a734c9de9c17c41da1f26359755696f0df40685c42f2.html]
  • Signing: Authenticode-signed PE (certificate embedded in IMAGE_DIRECTORY_ENTRY_SECURITY). Certificates observed: self-signed atom.hutsell.com/WR3, Let's Encrypt R12 blizzard-tecnica.com, Sectigo DV sedo.com, and — as of Aug 2026 — valid GlobalSign DV TLS CN=seekingalpha.com.
  • Obfuscation: Randomized Go module path (e.g., vcCgXjVCTGAvGkl, PfeYrYvazVUGgZq, UwKaCILheRgWMLk); randomized function names in the main package; no external packer (entropy ~6.19 in .text)
  • Resources: .rsrc section contains multiple icons up to 256×256 PNG, used for social-engineering masquerade

See golang-stealer-build-pattern for the full build-pattern concept.

Deploy / TTPs

  • Execution: Seed PRNG with current time to decode runtime-decoded C2 strings ^[/intel/analyses/6871848bb724a184e393a734c9de9c17c41da1f26359755696f0df40685c42f2.html] ^[/intel/analyses/c577c6c87bd8a143598000e63d53c8e09b4f7d7a8b8c5de36f7479b5f4411274.html]
  • Network: Contacts C2 via direct IP (5.252.155.72) and domain (laserlogdnsop.icu) over TLS/HTTP (implied by crypto/tls and net/http linkage)
  • Collection: Targets browser credential stores, cryptocurrency wallets, and FTP/SSH credentials (family naming convention; no static confirmation in these specific samples)
  • Exfiltration: POSTs collected data to C2 endpoints (inferred from standard Go library linkage and family behaviour)

Capabilities

  • runtime-randomized-c2-decoding
  • tls-https-c2-client
  • browser-credential-dumping
  • cryptocurrency-wallet-targeting
  • ftp-ssh-credential-theft
  • signed-pe-masquerade
  • unsigned-binary-build-toggle (first observed: cf018bde)
  • resource-icon-social-engineering
  • prng-seeded-string-decode
  • go-static-binary-no-cgo
  • custom-in-memory-pe-parser
  • multi-pass-byte-transform-decoder
  • reflective-loader-goroutine
  • go1.18.5-legacy-build-divergence
  • go1.25.4-toolchain-divergence
  • null-pe-timestamp-stripped
  • no-static-c2-fully-runtime-decoded

Variants / Aliases

  • OpenCTI labels: acrstealer, laserlogdnsop-icu, flur-constzoo-surf

Notable Analyses

  • /intel/analyses/0bc8490a5870f5a734aeab818fa39e919c7c221ab1071d323740871c593c398c.html — Thirty-second confirmed sibling, Go 1.25.4 PE32+ x64, module DUYgnKaDgqSNwmD, 66 randomized main.* functions (heaviest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (sixth confirmed sample on this chain), .rsrc five-icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/6871848bb724a184e393a734c9de9c17c41da1f26359755696f0df40685c42f2.html — Signed Go 1.26.2 PE32, randomized module path vcCgXjVCTGAvGkl, C2 5.252.155.72 / laserlogdnsop.icu
  • /intel/analyses/c577c6c87bd8a143598000e63d53c8e09b4f7d7a8b8c5de36f7479b5f4411274.html — Sibling build, identical toolchain, module PfeYrYvazVUGgZq, same C2 infrastructure
  • /intel/analyses/16a4344dcdb51bd043a360dd954bbee9ed5d497dce177e3114740598cc90d78b.html — Third sibling, module hlHtIOAoWQhvCrI, cert CN=me.muz.li / issuer R13, same C2
  • /intel/analyses/d5655568fee9c610139d41d367afc74e768e1c8baf70e37912e9ebeb27b5d411.html — Fourth sibling, module JPYhJIzovpOdAaG, same cert CN=me.muz.li / issuer R13, adds custom PE parser and multi-pass decoder (TTPs shared with orderreshop)
  • /intel/analyses/1bfebf79c24d0813eb39fec74637d52b008188812631a4f666a59fae7c0cef2c.html — Fifth sibling, module rDRsLkGEEednpRk, cert CN=me.muz.li / issuer R13, C2 domain hertzfigblob.icu (new rotation)
  • /intel/analyses/f93d8d79ae62c9864e53e5abf92f5c905c358b6ac397c69418765a303947c1d1.html — Sixth sibling, module gesiimdPYMojqEh, cert CN=me.muz.li / issuer R13, stripped .rsrc section (no icon masquerade), no C2 domain in static strings
  • /intel/analyses/624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.html — Seventh sibling, module yCJjClxMaPcdOeL, cert CN=me.muz.li / issuer R13, .rsrc icons intact (masquerade active), static C2 fully absent — runtime-decoded or DGA
  • /intel/analyses/d353d849b0a656ad633b677bd3413c5da9975bfac34c90927b948ee1289f058c.html — Eighth sibling, module JyUjBKWCTzoLKTp, cert CN=me.muz.li / issuer R13, .rsrc icons intact, static C2 fully absent, PRNG-seeded runtime decode (same pattern as sibling 7)
  • /intel/analyses/7620884e50fd7741417ecdb81b41f7c7d9452b89d6905a837ad30a7bc8dc9969.html — Ninth sibling, module rjVxxnjkTTMPaie, Go 1.25.4, cert CN=blizzard-tecnica.com / issuer R12 (cross-cluster overlap with lummastealer), .rsrc icons intact, PRNG-seeded runtime decode.
  • /intel/analyses/ef262340421fcb93d5f0c0d0bf418bc9fc6224398dda3093028ed8c97cc5bba7.html — Tenth sibling, module EHxLjGaKNUDBcAy, Go 1.18.5 (oldest toolchain in cluster), self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc icons intact, no static C2. No custom PE parser / multi-pass decoder.
  • /intel/analyses/6cbac6bcd1acb90031a31b9595deb4e9681450b9554a9e61e4fd20d81e450a0e.html — Eleventh sibling, module AhfGUgsIWgxFnho, Go 1.18.5, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical to ef262340), no .rsrc section (builder stripped icons), PE32+ x64 (first amd64 build in cluster). OpenCTI mislabeled as remusstealer.
  • /intel/analyses/44f594e2a9168c6de0d3f74e0d493920fac5210a49ebc73b6bd292eede9e81cd.html — Twelfth sibling, module aElVPjiacFfVnfJ, Go 1.18.5, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical to ef262340 and 6cbac6bc), .rsrc icons intact, no static C2 (PRNG-seeded runtime decode per family pattern). No custom PE parser / multi-pass decoder. Same cert validity window (Apr–Jul 2026) as ef262340. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/828405d66881b770753d58349534c978672cda97591e8eb393beca734896539a.html — Thirteenth sibling, module numdYMGwZeUHIry, Go 1.18.5, PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical to ef262340 / 6cbac6bc / 44f594e2), .rsrc icons intact, no static C2. Second amd64 build in cluster (after 6cbac6bc) but restores .rsrc that 6cbac6bc stripped. No custom PE parser / multi-pass decoder — lightest Go 1.18.5 variant. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/350a2b69e5de4c35dc2b9592e145ff425373356cb2fed475716e1bf7455dd802.html — Fourteenth sibling, module YUJFqOiYcDAmDOn, Go 1.18.5 PE32, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical to ef262340 / 44f594e2 / 6cbac6bc / 828405d6), .rsrc icons intact (builder icon-toggle restored), no static C2 (PRNG-seeded runtime decode). No custom PE parser / multi-pass decoder. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/beff95d5326762401e1ea804d3c75f8cc71533f152a5711361476ce466b39b54.html — Fifteenth sibling, module Qdsgwo / Xyhjsh / Eqobani (22 randomized main.* functions), Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical cert to ef262340 cluster), .rsrc section absent (no icon masquerade), no static C2. OpenCTI mislabelled as remusstealer (same false-positive as 6cbac6bc). Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/119b387e12f79637227c095822f018cc3cfb6e1111e0e473e6edadcbc08cf350.html — Sixteenth sibling, 54 randomized main.* functions, Go 1.18.5 PE32, self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc 256×256 PNG icon intact, no static C2. Static-only (CAPE skipped — no Windows guest). Report + entity update + index + log updated.
  • /intel/analyses/b0bc17dda19e36d395e354f6a861e93a70780029bb35116ea3616e316c588710.html — Seventeenth sibling, 90 randomized main.* functions (heaviest count in cluster), Go 1.18.5 PE32, self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc four-icon suite intact, no static C2, lightest Go 1.18.5 variant (no custom PE parser / no multi-pass decoder). Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/38cf89b07d7036ff09ead8bef8c22aa26949cb7863eeb3b02692ffa9ca954138.html — Eighteenth sibling, 11 randomized main.* functions (smallest count in cluster), Go 1.18.5 PE32, self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc four-icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Unique build ID. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/76a51fb7d82bcdb120f3128172ec5682f630789b8b4aa9450dc65184ea3a15e6.html — Nineteenth sibling, module DyLfjKADwKUPEjD, Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc four-icon suite intact (256×256 PNG), no static C2, no custom PE parser, no multi-pass decoder. Eleven randomized main.* functions (joint-smallest in cluster). Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/4c15644f4a1d25cfdacecd5618eb88637d994a031a8c6f8c772a5db01ada3080.html — Twentieth sibling, Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc four-icon suite intact, 53 randomized main.* functions (heaviest x64 build in cluster), no static C2, no custom PE parser, no multi-pass decoder. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/7945e84f90503d5b839ec6bda0d7ea7b8287abf8e692f0d40ab75d0df59b61b3.html — Twenty-first sibling, module UyiuGZEejgKpFWS, Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical to ef262340 cluster), .rsrc four-icon suite intact (256×256 PNG), 54 randomized main.* functions (tying with 119b387e for heaviest PE32 count), no static C2, no custom PE parser, no multi-pass decoder. Light Go 1.18.5 build matching baseline ef262340 template. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/f251271a7492deec499dbe387d5b0500ef3fe2bb8f8b0d86940bac97c11f7345.html — Twenty-second sibling, module ejQKyonMyjeZaWq, Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical cert chain), .rsrc four-icon suite intact, 90 randomized main.* functions (tying with b0bc17dd for heaviest count overall, and heaviest x64 build in cluster). No static C2, no custom PE parser, no multi-pass decoder. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/8f454dc17a40b766bd1cb6beaf50330ddbc89450a11149d1648a79329e393fe8.html — Twenty-third sibling, Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical cert chain), .rsrc four-icon suite intact, 90 randomized main.* functions (tying cluster record). No static C2, no custom PE parser, no multi-pass decoder. Light baseline build. Module path not recovered statically. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/e535cab50e8134087f804a818c9c96098e56520a27bb0b35c82de020937938b4.html — Twenty-fourth sibling, Go 1.18.5 PE32+ x64, module BMPHSkKmFnRuuMP, 60 randomized main.* functions (mid-range count), self-signed cert CN=atom.hutsell.com / issuer WR3, .rsrc four-icon suite intact (256×256 PNG), no static C2, no custom PE parser, no multi-pass decoder. Baseline build. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/cdd16fc0a2bf1499ba815bc95288456e46c7245b64c9d06033f2c61eb06900f5.html — Twenty-fifth sibling, 65 randomized main.* functions (mid-range), Go 1.18.5 PE32+ x64, self-signed cert CN=atom.hutsell.com / issuer WR3 (identical cert chain), .rsrc section absent (builder stripped icons), no static C2, no custom PE parser, no multi-pass decoder. OpenCTI mislabelled as remusstealer — third confirmed false-positive on this cert sub-cluster. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/f010585162a905c486b5ddd0cdae3ad5ad232c94a6091ed718692c8f72b0b68a.html — Twenty-sixth sibling, module UwKaCILheRgWMLk, Go 1.20.6 PE32, valid GlobalSign DV TLS cert CN=seekingalpha.com / issuer GlobalSign Atlas R3 DV TLS CA 2025 Q4, .rsrc four-icon suite intact (256×256 PNG), 90 randomized main.* functions (tying cluster record), no static C2, no custom PE parser, no multi-pass decoder. First observed sibling with a commercially-trusted DV TLS certificate. Static-only (CAPE skipped — no Windows guest).
  • /intel/analyses/f668de57394d23a70ea59fcf2039b14ad28a479d59e4dc06ed31c64d740be30c.html — Twenty-seventh sibling, module zlTZogJDhiAeqAW, Go 1.25.4 PE32+ x64, self-signed cert CN=quiverquant.com / issuer WE1 (new cert chain), .rsrc two-icon suite intact (16×16 + 256×256 PNG), 56 randomized main.* functions (mid-range count), no static C2, no custom PE parser, no multi-pass decoder. Newest Go toolchain in cluster (first 1.25.4 observed). Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/1cf857a9b341295ce170abd7d79f66e1d2026adc39927e97a658a1af097e52c1.html — Twenty-eighth sibling, module UJUqzYcyeFCIoUH, Go 1.25.4 PE32+ x64, self-signed cert CN=quiverquant.com / issuer WE1 (second confirmed sample on this cert chain), .rsrc five-icon suite intact (16×16, 32×32, 64×64, 128×128, 256×256 PNG), 56 randomized main.* functions (mid-range count), no static C2, no custom PE parser, no multi-pass decoder. Light baseline build. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/725dc07c0f1b552ac6df04855134a866679c97b320c27514050c43be51516c91.html — Twenty-ninth sibling, module KdPawPMBlXxJKvg, Go 1.25.4 PE32+ x64, self-signed cert CN=quiverquant.com / issuer WE1 (third confirmed sample on this cert chain), .rsrc five-icon suite intact (16×16, 32×32, 64×64, 128×128, 256×256 PNG), 92 randomized main.* functions (heaviest count on this cert chain), no static C2, no custom PE parser, no multi-pass decoder. Light baseline build. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/c69b14a0503d3cedeabb0131f533b44945502d41841152e5ebe8072417d1ff5f.html — Thirtieth confirmed sibling, Go 1.25.4 PE32, self-signed cert CN=quiverquant.com / issuer WE1 (fourth confirmed sample on this chain), no .rsrc section (icon-toggle off), no static C2, no custom PE parser, no multi-pass decoder. OpenCTI mislabelled as lummastealer; resolved to ACR cluster by certificate chain. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/f258a5d72c7058a6d4f424b2c9bf0dd96a7ab8e4548ffc9f645f2da17cf64a29.html — Thirty-first confirmed sibling, Go 1.25.4 PE32+ x64, module URKJhYaxDMEJEqH, 55 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (fifth confirmed sample on this chain), .rsrc five-icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Light baseline build. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608.html — Thirty-third confirmed sibling, Go 1.25.4 PE32+ x64, 66 randomized main.* functions (mid-range count, tying 0bc8490a for heaviest on the quiverquant.com/WE1 chain), self-signed cert CN=quiverquant.com / issuer WE1, .rsrc five-icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Light baseline build, near-identical twin of 0bc8490a. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/bd7832157bc4ccff2632e3e457d47042fddd8327a72549f1dda6bb822c85f04f.html — Thirty-fourth confirmed sibling, Go 1.25.4 PE32+ x64, module KQkDRakDFmSptYY, 47 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (eighth confirmed sample on this cert chain), .rsrc five-icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Light baseline build. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/94cf86f6aab01670ea57aa08b8c531d8dbdda8cbcebbe684b08c64b5738cc819.html — Thirty-fifth confirmed sibling, Go 1.25.4 PE32+ x64, 11 randomized main.* functions (smallest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (ninth confirmed sample on this chain), no .rsrc section (icon-toggle off, matching c69b14a0 and cdd16fc0), no static C2, no custom PE parser, no multi-pass decoder. OpenCTI mislabelled as vidar; resolved to ACR cluster by certificate chain. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/c64eb93f00c92ad6367df8de17e7360ba57a34a4e2a85fe7322952513daa50d4.html — Thirty-sixth confirmed sibling, Go 1.25.4 PE32+ x64, module fPkQKdkjTpkkdga, 64 randomized main.* symbols (highest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (tenth confirmed sample on this chain), no .rsrc section (icon-toggle off), no static C2, no custom PE parser, no multi-pass decoder. OpenCTI mislabelled as vidar; resolved to ACR cluster by certificate chain. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ||- /intel/analyses/43998b11d473dd4ddc92545ef21b5bde25d99ca31b7c6346f89ced93d9574002.html — Thirty-seventh confirmed sibling, Go PE64+ (PE32+ x64), 11 randomized main.* functions (smallest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (eleventh confirmed sample on this chain), no .rsrc section (icon-toggle off), no static C2. OpenCTI mislabelled as stealc and vidar; resolved to ACR cluster by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
    • /intel/analyses/c5b8d1b89af16d100021edb32f085de5704eee08bc51bd3edc82f0a997981c36.html ||- /intel/analyses/c5b8d1b89af16d100021edb32f085de5704eee08bc51bd3edc82f0a997981c36.html — Thirty-eighth confirmed sibling, Go 1.25.4 PE32+ x64, module xTDyRMuufAbmowN, 92 randomized main.* functions (mid-to-heavy count), self-signed cert CN=quiverquant.com / issuer WE1 (twelfth confirmed sample on this chain), no .rsrc section (icon-toggle off), no static C2, no custom PE parser, no multi-pass decoder. OpenCTI mislabelled as vidar; resolved to ACR cluster by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.
  • /intel/analyses/3f7d51dd1fd7024371b155765420f2220d247a49fdc593b2eae02bc96b2a206c.html — Thirty-ninth confirmed sibling, Go 1.25.4 PE32, module rPNTPRIvOgSxctC, 42 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (thirteenth confirmed sample on this chain), no .rsrc section (icon-toggle off), PRNG-seeded sleep gate (800–1120 s), runtime C2 decode. OpenCTI mislabelled as lummastealer; resolved to ACR cluster by certificate chain. Static-only (CAPE skipped — no Windows guest). |- /intel/analyses/6baf80c1eeefc7c02d0ad16cdc5e375253bf104e7915f8ececacd8f4b372d15c.html — Fortieth confirmed sibling, Go 1.25.4 PE32+ x64, module edmjkExqBBpnduw, 49 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (fifteenth confirmed sample on this chain), no .rsrc section (icon-toggle off), no static C2, no custom PE parser, no multi-pass decoder. First x64 build on the quiverquant.com/WE1 chain. Static-only (CAPE skipped — no Windows guest). Report + entity update + index + log updated.
  • /intel/analyses/b39688635bb5b2a90bb9101b372080b61d6ba78f2cd78ee275a983a84e2a047d.html — Forty-first confirmed sibling, Go 1.25.4 PE32+ x64, module kDIdfdDYIETHOsK, 65 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (sixteenth confirmed sample on this chain), .rsrc five-icon suite intact (builder icon-toggle ON), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI labels cloud55file-cc / neuralpulsecore5-sbs contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.

||- /intel/analyses/1b98937b0559f1b27de90a7d5e767c3b11464d2b40db87608bf788f619b9832b.html — Forty-second confirmed sibling, Go 1.25.4 PE32, module jjpTdnXpemRvtWL, 11 randomized main.* functions (tying smallest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (seventeenth confirmed sample on this chain), two-icon .rsrc suite (builder icon-toggle reduced from five), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI labels cloud55file-cc / flur-constzoo-surf contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity updates + by-family symlink + index + log updated.

  • /intel/analyses/c0a47856e9f60a5be5ac0cab0b92452198a3f10b6f98dbcbf1d153927915809c.html — Forty-sixth confirmed sibling, Go 1.18.5 PE32+ x64, module ecoDNZCUvXTdkYk, 81 randomized main.* functions (third-heaviest in cluster), self-signed cert CN=atom.hutsell.com / issuer WR3 (seventeenth confirmed sample on this chain), .rsrc icon suite intact, no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI label cloud55file-cc contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity updates (acrstealer + cloud55filecc) + by-family symlink + index + log updated.

|- /intel/analyses/58eda486d34d649502ff6f451760ef1fb340c15ed808c226e9831e785d39dc04.html — Forty-fourth confirmed sibling, Go 1.20.6 PE32+ x64, module not recovered statically, 90 randomized main.* functions (tying cluster record), valid GlobalSign DV TLS cert CN=seekingalpha.com / issuer GlobalSign Atlas R3 DV TLS CA 2025 Q4 (third confirmed sample on this chain), four-icon .rsrc suite (builder icon-toggle ON), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI labels cloud55file-cc / neuralpulsecore5-sbs contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.

||- /intel/analyses/a02296ceeb8f1419fe18a4376ce3b563e5de0fe8d85e7bf1b8461784d3c17992.html — Forty-third confirmed sibling, Go 1.20.6 PE32, module XXjuhfDdZFXrSHR, 34 randomized main.* functions, valid GlobalSign DV TLS cert CN=seekingalpha.com / issuer GlobalSign Atlas R3 DV TLS CA 2025 Q4 (same chain as f0105851), two-icon .rsrc suite, no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI label cloud55filecc contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + index + log updated. |- /intel/analyses/ba1af85880677c82be1c4388452fad1874f2edf73e5cd1521553c3710cf63ffa.html — Forty-fifth confirmed sibling, Go 1.25.4 PE32+ x64, module UbaSUgsUHMKzoZw, 66 randomized main.* functions (tying cluster record for heaviest count on the quiverquant.com/WE1 cert sub-cluster), self-signed cert CN=quiverquant.com / issuer WE1 (seventeenth confirmed sample on this chain), five-icon .rsrc suite (16×16, 32×32, 64×64, 128×128, 256×256 PNG), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI labels cloud55file-cc and neuralpulsecore5-sbs contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. |- /intel/analyses/8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce.html — Forty-seventh confirmed sibling, Go 1.25.4 PE32, module LkYepTgpfGoTJPv, 11 randomized main.* functions (tying smallest count on the quiverquant.com/WE1 cert chain), self-signed cert CN=quiverquant.com / issuer WE1 (eighteenth confirmed sample on this chain), five-icon .rsrc suite (builder icon-toggle ON), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI label cloud55file-cc contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated.

|- /intel/analyses/5ef623d696ac40bb710cd841fb558136c8325401b08cc680f8cb56fc16bc9917.html — Forty-eighth confirmed sibling, Go 1.25.4 PE32+ x64, module SSvPYYKzNMNpCZi, 42 randomized main.* functions (mid-range count), self-signed cert CN=quiverquant.com / issuer WE1 (nineteenth confirmed sample on this chain), no .rsrc section (builder icon-toggle off), no static C2, no custom PE parser, no multi-pass decoder. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ||- /intel/analyses/cf018bde848f9ff756f653a778e4a73ea10c9ef47f4c49e1b062523b31a9e172.html — Forty-ninth confirmed sibling, Go 1.25.4 PE32, module cdGTykpGcrRGbKz, 51 randomized main.* functions, no valid Authenticode signature (security directory RVA 0x46a600 exceeds file bounds — first ACR sibling with fully absent/malformed cert), eight-icon .rsrc suite (16×16 through 256×256 PNG, builder icon-toggle ON), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI label depumped contested; resolved to ACR by Go build fingerprint, module-path randomization, and PRNG sleep-gate decompilation. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ||- /intel/analyses/ea41d4b15a8e270f2113b16f050cb3e15cb5a5c85711fb6ec31dc6bb7279ba42.html — Fiftieth confirmed sibling, Go 1.20.6 PE32+ x64, module LEMEXLlSisSswHg, 81 randomized main.* functions (heavy count), valid GlobalSign DV TLS cert CN=seekingalpha.com / issuer GlobalSign Atlas R3 DV TLS CA 2025 Q4 (fourth confirmed sample on this chain), four-icon .rsrc suite (builder icon-toggle reduced), no static C2, no custom PE parser, no multi-pass decoder. Preliminary OpenCTI label remusstealer contested; resolved to ACR by certificate chain and Go build fingerprint. Static-only (CAPE skipped — no Windows guest). Report + entity update + index + log updated.

Related