ACRStealer: Rapid Self-Deletion of Proper.a3x/BrowserMetrics After AutoIt/IExpress Chain

Duo Tech@duotech

•updated Aug 17, 2026•1•0•4

Detects rapid self-deletion of the initial ACRStealer payload artifacts (Proper.a3x, BrowserMetrics) within 5 minutes of their creation by the setup_patched.exe/AutoIt execution chain — an indicator-removal behavior.