Extracted

• • Target

    proga.exe

  • Size

    1.8MB

  • MD5

    37d52955fa43a9b6914f81fac04f0656

  • SHA1

    ef005ff7f596ea057022a77f111847ac8b3fb66f

  • SHA256

    481e16bd9e829fee9cd41bd992a3287e5882a041b8306029eb7785a66bb4a1ac

  • SHA512

    9126bcda7b7ac8b3bc0b9a31981150f8fe59bca93f17b6322d04033ff6567df47d18e2833072c06235502e8a9bf5324967d31bbfd765805dfbc083aeb0d91c24

  • SSDEEP

    49152:1Djlabwz9DmRaIKolB7bLpEBm9ggukQ2XC+N7:ZqwRmaQ5k0ukHS+x

  Score

  10^/10

  44caliberdiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1