Extracted

• • Target

    bd1b3b496b17b6ebbc19483dc8fd2b38_JaffaCakes118

  • Size

    1.7MB

  • MD5

    bd1b3b496b17b6ebbc19483dc8fd2b38

  • SHA1

    e9baac0c912cf6092a7cf87c171b044efa6b0d4c

  • SHA256

    addc15bc47d8feee37c20659259b5c1c17fb63608b42bf358ab1248a6c660156

  • SHA512

    18fe41b9f9d9994a8bb1797ef7592d77f7b835a7174e6faa2f0676cfdf8a856bb86ae7add02d89579968c46ff2b8be531116e8a294d1b362e391ba51669a986f

  • SSDEEP

    49152:ug0jh8JRTIGVVK+3BhD6kWp2i2V7nYpldF5F8wsuHHHf:uPSjcGVUupWp2r1n8ZDnH

  Score

  10^/10

  44caliberblackguarddiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Blackguard family

    blackguard

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2