Extracted

• • Target

    fe7fc1c78b51d7a796562e09b0695353

  • Size

    5.1MB

  • MD5

    fe7fc1c78b51d7a796562e09b0695353

  • SHA1

    2df2d7b7edc5db2a94ad4428a7fd354650bfe49d

  • SHA256

    24803b2f05f7eaa2d0d13c5655987459ef3ee8169d83be8c78683d70de95ddc0

  • SHA512

    5d17f20a5a74aab071c5ee0cc98200d46487734dc899d9bae623ae34e5664aa0b315d9178cfee1b8500a3564197bcdd749e428c9832ba2a749e06d1ed2b22607

  • SSDEEP

    98304:n4jbjW+MvAuGdozQQQYeclr+UiO58O72LHozpAsRS1FsQvsw0R:abjhxgHeclA08OAIzpRo1SN

  Score

  10^/10

  44caliberspywarestealervmprotect

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2