Extracted

• • Target

    5905d3f9053ed0c00b17f370e3939858

  • Size

    2.6MB

  • MD5

    5905d3f9053ed0c00b17f370e3939858

  • SHA1

    cd49b4a65523765a0fda10ec5e3957d2c6dd6752

  • SHA256

    39ad062f3182bdcd954f2c4fbc82ae8404fe85aa0ec119d2e63ec6f6c1983312

  • SHA512

    dc8169df03314b27906bb5f99027858580e4a391f20f7a9391739a92c4fcec672ba97312b795598424b2f972c826a0d0609f22a135cbf33dcf3e692fc541e0c9

  • SSDEEP

    49152:Yt5WvcAwxgqAhSyUo99eBQQPim8Pv+RAG/2Xc7xyW2o7uKV9RZSTcZ:Y/jAhg/p78Pv+HxyW2wucRZSTE

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2