Extracted

• • Target

    0f13239f4af5dc1c7dd7fdcfe1330c02fe31410935208a57ba8e5c53e4aa2680N

  • Size

    7.5MB

  • MD5

    013b74f725ebc6449ce2e1eb545aeb80

  • SHA1

    5eacf5e9fc03f8641f467b82352b131e3c59ca61

  • SHA256

    0f13239f4af5dc1c7dd7fdcfe1330c02fe31410935208a57ba8e5c53e4aa2680

  • SHA512

    da310873a6f23e00c859e43dbdcb11c5a0c57de1c19f1e73b6b62f6d29390fb8fdca04ea6be0f85472e8e07447ae05dce4d189b8ee9d9529a05686afe26610fb

  • SSDEEP

    196608:OPU39DbBHnbYq2EF6sXCXheIy9uG0jaIj:b39DVYqQ9XheIyvy

  Score

  10^/10

  discoverypyinstaller44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2