Extracted

• • Target
    2026-09-01_00a8b5d2201a8c3eb84b317072543779_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 547KB
  • SHA256 866cc8960835e9f1f64e2ae5a2e38e30773d5cfd92f00f45fe5a2ebc2b52af18
  • MD5 00a8b5d2201a8c3eb84b317072543779
  • SHA1 47afb6a1f3f8f87a5a9ca6a42c01f668c755401f
  • SHA512 5a7418a64306a234c0591d843ebff909f9d6ca197a80ddec5b72a9a87d7070688f803572db0eb4512ca7ab1008abbb0d676acff4aebbfb934ad1a02adf236463
  • SSDEEP 12288:JciZ4qN4ZkKdcLtmUzG8GIJ9E2OI75Xo7AvO/dRNy:m25kkKdcLt08/9DOIN47r/dK
  • TLSH
    T14FC49E19D7F405FDE1B7E578CE834912EB7678494761E7CF03A499A21F232908E3AB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discovery44caliberspywarestealer

  • Family: 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables referencing Discord tokens regular expressions

  • Detects executables referencing credit card regular expressions

  • Detects executables referencing many VPN software clients. Observed in infosteslers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2