Extracted

• • Target

    RP.sfx.exe

  • Size

    10.0MB

  • MD5

    e335f71c0f053c393626691bd60a58a4

  • SHA1

    0cc99df70cca24c5f96edf36672ea297fe71043f

  • SHA256

    af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1

  • SHA512

    eaa5b09100e133cd7241258255c02be262d3f6061774f9d32424922aaae8fa04d148f665d7c61c6f7ac1f1a23e87994b7bc6b0ba7fdd2fd0fa2d4575ac460195

  • SSDEEP

    196608:uchhf7FHaM6MkwG2ea8oQoidqpcO49UEahKBXSmLnS0rCqs2vm9EGgy:dvfBdPG2QzoY1OgUEPV7r9s2+9bgy

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2