Extracted

• • Target

    8d88b6afcfdf51afa91d7fbdbda3123f

  • Size

    3.7MB

  • MD5

    8d88b6afcfdf51afa91d7fbdbda3123f

  • SHA1

    8992be4a6ad43f41f4098f5f6e16c52ce1a15128

  • SHA256

    f1a5c8f4f3ab1e52cb2b85da2c0a0a1196600d77864b2a08f10994df7ca19e47

  • SHA512

    1df17fbc715acee1c6a8067372c08e6566b50a92840af6d3369d00cf6f0cad9256f5d16f22f57055db89a9fb10520506f51f97eabf5177201f31fe9119df1527

  • SSDEEP

    98304:ebvEDT/eSXK4YubNjNS/AAjz0h+9I/E9rep:eE/LYuFNp4++hSp

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2