Extracted

• • Target

    07b03eeff0d15ffa67346df3c0d0aceaa18be760811579e274066f3f2c5ec9e9.exe

  • Size

    1.7MB

  • MD5

    8919a3ebfb67cc3d12f475baa82ca476

  • SHA1

    0e6aa733c49dc293f2936b32600390cedb0767ae

  • SHA256

    07b03eeff0d15ffa67346df3c0d0aceaa18be760811579e274066f3f2c5ec9e9

  • SHA512

    eac4ba93e8f84413a4d5a4e590263c493011cdfa2a6b96dee2222930a22c30ef885d4651d0783b10c26b8b75cc1f61c32302671dcf9de9f1a3dd19a29c1d1593

  • SSDEEP

    24576:rcbD/3+3Nb8c6xUN8c/CNlSC3Af8XwYJs4nUAo3E5IuquLJlxpCp8zMgNFLtU5Vp:rcbz+3H6NXL3cYi4nUpmIm2BIG5VBj

  Score

  10^/10

  44caliberdiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1