ACRStealer dropper, AutoIt payload, and DCRCVDrv.sys BYOVD driver static indicators

Duo Tech@duotech

•updated Aug 17, 2026•1•0•3

Static file-based detection of the ACRStealer dropper, encrypted AutoIt payload, and DCRCVDrv.sys BYOVD driver via filenames, service/device names, signer names, and certificate serial. Certificate/signer matches only fire in combination with the driver file or service artifacts to avoid flagging the legitimate vendor certificate alone.