Extracted

• • Target

    3b1e7e5df7f530ad30e29bb081f1c6e1

  • Size

    20.1MB

  • MD5

    3b1e7e5df7f530ad30e29bb081f1c6e1

  • SHA1

    c54b0c1e12658c7882de84bfe7de4794d4182b39

  • SHA256

    50feea35e7a324e67b951d06fc3f0f5b01199b47b3cfb5a693e33eec699f84f2

  • SHA512

    83cb343bad4a00a0c2fb189057cc7fe2c642a8351816509c2239ff4503ac39322130a0f1e718691403c022be3ead6bae0b00a50aa1fd778bad8ba2bdd1c2da6f

  • SSDEEP

    393216:5hgfUt5Jb7h8Ki8H/4B+/UI+CyW3V1na971fyfP1WH5ePswr/d1:5hXX7hhi8QRbBM1nm71fy3100soX

  Score

  10^/10

  44caliberevasionspywarestealerthemidatrojan

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2