Extracted

• • Target

    d008b5ac1b929144d485b6042baebe2b

  • Size

    14.7MB

  • MD5

    d008b5ac1b929144d485b6042baebe2b

  • SHA1

    d3f1da5864d24d0f1c86e24ab56322df55206100

  • SHA256

    81e5007b1563752afaded075c7d864a85da680f1a07f4f38cdb0326a31658401

  • SHA512

    6e1c2d1edd951856b4fedd2b8e2226124e80c4fee101597ec82f71197e24c1cef86034add6336d0f3d3a0cd95edeb4409a33e832a8dec3f29e790678328b5146

  • SSDEEP

    393216:Xa664wtF3JuBnaO6Fje2fXVI/Hy3AYtDDD:v6j3U541e8VqS3AKDD

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2