Extracted

• • Target

    Loader.exe

  • Size

    9.2MB

  • MD5

    8e4bc9547894a5ede75a2bd4235a8fb9

  • SHA1

    794f7e9856e5024bcce49c1ce5415ee70abfdb88

  • SHA256

    ede32cc0261506b8e6fffd357c22b175ce5a45a2de83f65b49d4484ec0e969f5

  • SHA512

    6ed8462f58af3bbdff9451d659f93b8214db5912f2045d483d4a8278114633d07f76a78c1ee8b4661f858ae5730a7a175d0554c3e1d672ccfb603c74a4bec03d

  • SSDEEP

    196608:6rltiwhW9T7MdeNBn6hKmXoBiibJkuJU1WcaonK+i7:Q+90deNBnYYBHyEcaI3i

  Score

  10^/10

  44calibercredential_accessspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1