Extracted

• • Target
    Soundpad.exe
  • Size 5.7MB
  • SHA256 134a7a430d8596107b571a39bc274bb25ef12c0996c0c670862855b74c52af1e
  • MD5 e7e6b753b8669ad8c171355bea2b0e53
  • SHA1 cd4ce6131e388146994104c10e7bb25f1952a60d
  • SHA512 1e5467570dad3d879565488f8a4081f0ebe73ecaa37b5b14f66502cd032479ca09e97a1dc2e3f91a7296084b02ebf348e6e0570801a23689b1f62fc520ebcb39
  • SSDEEP 98304:0qwSYRn8Bm6QwT9GErvQ3bw7XALy/mu6zzMaSzQzCnF5fQ/P/BeeZ:0qwSq8Bm6XJvvQ3VNYNdnFheZ
  • TLSH
    T14A56234AE3E419FCE0BAF13C98675906E6B6BC4E4371969F2369112A2F13790DD3E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  44caliberpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2