Extracted

• • Target

    8739059e823d0546bec6151fd4feac47

  • Size

    1.2MB

  • MD5

    8739059e823d0546bec6151fd4feac47

  • SHA1

    84290df98276fae83555efe09b155fe5bac9dd94

  • SHA256

    b2fa3170b65e72aaf86c381aef876ea2cd53812a7928d6bd5ee10d9f80a8da1c

  • SHA512

    f1f0533f570a9b7c340f6f69850d0a878b0d9ea6ff0170defde96b1df4a5749509b6b826e8de864cdcb376a4549e5382593aaed2e99350bac3295047bfd9bd7a

  • SSDEEP

    24576:oRvt2ZygClb0xvqEcS07g6RUChgQpVmSP+HV/mi7LZtj1nGzcgx:oRz0xv9cS0geUopVxO5DLZtpnGzp

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2