Extracted

• • Target

    66721cc45af725f154418a09d4a68ec6

  • Size

    747KB

  • MD5

    66721cc45af725f154418a09d4a68ec6

  • SHA1

    632a75f4263174cc19942a144fc7087b00b5486e

  • SHA256

    0ea8e2910cb2a2a4b11be49d5e126ee142006b8081835e0a7df915d7888298ba

  • SHA512

    dfa77713a46330fec13af7a613713920a0d20ba6ab29fff636c0ce0bfdec4d618f078dbd1ec3b84dd68199275d05d26cce9daf2b2fdfad234e842b01e1911cbd

  • SSDEEP

    12288:VhqxSLo5C1Ps4XhWT+trB8lUvGNVB6d/30BPU54PaklHqs:VHLmCiIhjjGvcdclU5kbp

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2