Extracted

• • Target

    cad08e451d55430d75c26f822b2a2b1b

  • Size

    463KB

  • MD5

    cad08e451d55430d75c26f822b2a2b1b

  • SHA1

    b86360aa685f4376381292d8564333142dee73e0

  • SHA256

    35b49b5014f2f16bc9565866e1d3394b39eefe7462d671ebc4c1b3c61dce30a2

  • SHA512

    121dd30c33e9792cd99e031cac5eb07b77ddea688658dfe6e0087409fd3377c23e2ecacbe07e8a64856bb625f62954874a2709fb4f3e274829ca6b3a22981c7c

  • SSDEEP

    12288:D8oHBAoI2UUfwt53D3NPEXkh18ICbTLOIX:goHBAF5r3DMkhXCbTSIX

  Score

  10^/10

  44caliberspywarestealervmprotect

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2