> Family · cloud55filecc — Contested OpenCTI label_

~/packetpursuit $ cat /intel/families/cloud55filecc.md

typeentityconfidencelowcreated2026-08-16updated2026-08-17malware-familyinfostealergolangsigningcontested

cloud55filecc — Contested OpenCTI label

OpenCTI preliminary label cloud55file-cc assigned to a cluster of Go-based PE32 infostealer samples. Static analysis of every sample bearing this label in the PacketPursuit corpus resolves to the acrstealer cluster by shared certificate chain, Go build fingerprint, and randomized function-name pattern.

Resolution

The label cloud55filecc is an OpenCTI false positive / preliminary tag. There is no independent technical fingerprint that separates cloud55filecc-tagged samples from the ACR stealer cluster. All observed samples share:

  • Go 1.25.4 (or 1.18.5–1.26.2) static build ^[raw/analyses/1b98937b/report.md]
  • Self-signed or stolen-certificate Authenticode signing
  • Randomized Go module paths and main.* function names
  • No static C2 (PRNG-seeded runtime decoding)
  • Browser credential and cryptocurrency wallet targeting (inferred from family behaviour)

Confirmed Samples

At least 16 samples in the corpus carry the cloud55file-cc OpenCTI label. All resolve to ACR stealer:

  • 8bb023f2 — Forty-seventh confirmed ACR sibling, Go 1.25.4 PE32, module LkYepTgpfGoTJPv, 11 randomized main.* functions, five-icon .rsrc suite, self-signed cert CN=quiverquant.com/WE1. ^[/intel/analyses/8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce.html]
  • 1b98937b — Go 1.25.4 PE32, CN=quiverquant.com/WE1, 11 randomized main.* functions, two-icon .rsrc suite. ^[raw/analyses/1b98937b/report.md]
  • b3968863 — Forty-first confirmed ACR sibling, Go 1.25.4 PE32+ x64, same cert chain, 65 randomized main.* functions, five-icon .rsrc suite. ^[raw/analyses/b3968863/report.md]
  • a02296ce — Go 1.20.6 PE32, GlobalSign DV TLS CN=seekingalpha.com, 34 randomized main.* functions, two-icon .rsrc suite. ^[raw/analyses/a02296ce/report.md]
  • ba1af858 — Forty-fifth confirmed ACR sibling, Go 1.25.4 x64, module UbaSUgsUHMKzoZw, 66 randomized main.* functions, five-icon .rsrc suite, quiverquant.com/WE1 cert. See /intel/analyses/ba1af85880677c82be1c4388452fad1874f2edf73e5cd1521553c3710cf63ffa.html.
  • ed60a9ea, 7a1b5d1b, 7f9634ff, 642ecaab, c88a5bba, c0a47856, 58eda486, 538de680, 5588efb2 — Additional siblings sharing the same build pattern and OpenCTI label. Note: c88a5bba resolves to ghostpulse x86 YHClient morph cluster (DigiCert-signed), not ACR.

Capabilities

See acrstealer for the authoritative capability list. This page exists only as a contested-label disambiguation stub.

Related