Extracted

• • Target

    117b28e18c3cdee58cee6f5b4c6b708b

  • Size

    1.2MB

  • MD5

    117b28e18c3cdee58cee6f5b4c6b708b

  • SHA1

    bf3f7cf88712b01a8123d3836bf19f25b17a70ec

  • SHA256

    b356d0dfecf39874a2bbbe4cae33f580d91a8991860df23314f35950f574485c

  • SHA512

    3a2331e1f7266a262e308eab726ee43127631c7348e7931186d13f54577abb1a18a92d6a6664dc69a9cbe9098914bd0e6173d1adc634a545b9c87b3bedd600ea

  • SSDEEP

    24576:8Shu0Xd9baM1zjL0KfafjvjZLJNWttqmO96tY:8SL7VUfjJWttlO9IY

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2