Extracted

• • Target

    c75b299ee8d5af6943de2b98cd9d36389cf7f98cd36e68239afd520e5bbfec52

  • Size

    11.1MB

  • MD5

    f43381c52c7d3eab6347894ff1bf6d35

  • SHA1

    097a6a49f8ba7c10d7cc0ddca69c5c9036fc5213

  • SHA256

    c75b299ee8d5af6943de2b98cd9d36389cf7f98cd36e68239afd520e5bbfec52

  • SHA512

    bd05ef1fc7279445fa9ad50dd2400aaf7bc2643c5d13cabca20204afeaa77a4ac36c99395765ba85df3f401762ccf002327bd99d92018e9db669654ee3c5c874

  • SSDEEP

    196608:fFqdGKeCIfqQq1QsKW7nSxXJQTMypF24oTq8MyuSIoQIwunHpm7oDvqU9rvJSHgB:MGKeCnQq1QsKC9TxYbJuSIo/f9r0gyM

  Score

  10^/10

  44caliberpyinstallerspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2