Extracted

• • Target

    df61aa9b6626a6aed2da2edc8a33f0e5

  • Size

    971KB

  • MD5

    df61aa9b6626a6aed2da2edc8a33f0e5

  • SHA1

    1d493fa7505b140d4c13b66486b86c332bd96396

  • SHA256

    fa6eae73527d0fe9a5b011b225d21ea71f7d8363e57de3347ebb817ed3b43443

  • SHA512

    4989dba701959001a0f6e14053ebe9838e0350e7140fd7c96cccefc75f75aa77338bdce80ef1c5b98c8b3bc459a195c889925ae41ffeac9c8cc78050fcb0a30e

  • SSDEEP

    12288:sVyHqncOUXqqX6msZ1nTsIVqaa5F1Amx412JbUK4peOMnIKxJZzW4Jt4E2Tl+W+a:8GaqKXV63AmPpHD4E2TldgbkIN8n5+

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2