Extracted

• • Target

    af48cbe6bc2be0d4fdbc89f9a6b89f06

  • Size

    1.2MB

  • MD5

    af48cbe6bc2be0d4fdbc89f9a6b89f06

  • SHA1

    d05426cdeae28903bac323656fb91ea2b5bfa56f

  • SHA256

    01f415da08ef6afa3a98e884ae3224d2f9c18bf629ce31f464ed8873b7d618f5

  • SHA512

    f912183fa13c38a6e71a180cc66b6b0897d894faac9858c231c3474e73eb58366bbb0cb881ce0d9038fa5a7066cfa185ecfea289b717e90755d6901b954356d2

  • SSDEEP

    24576:4WFyaqH/njZbno7e2RIymxTWk1DzW8fK4OrkFI+XljVy:43ak/nR1YIymxCk1RQkFNXf

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2