Extracted

• • Target

    SoraStalcraftV2.exe

  • Size

    13.6MB

  • MD5

    38241bc2e9e9a3191ad8e92c632850ae

  • SHA1

    a9bcc7b97fbdaef560b0168bbf618d2e281118c5

  • SHA256

    f0d71adc29ffaedb669c408229ae18dd75e23617b775446c3d6b6350255ca854

  • SHA512

    8eb56e25100d5c703cf99202d6732357eb80afcc0df381e5221dea49b923b96f3840701949966c9b0d55ec095f08f31bbdd2487f0af47445bb83827d4179b71c

  • SSDEEP

    393216:nT61FeREWa6YW+eGQ0oMTozGxu8C0ibfEau5qW80hoA/aU3q:nT6jeRm6YW+e5CoztZ0x5qW80hVa

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2