Overview

overview

10

Static

static

10

cc3374a948...0e.exe

windows7_x64

10

cc3374a948...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc3374a948c98c5be192fd7318b405fe41816e6c372751773ca7b1c9d0d6360e.bin

  • Size

    303KB

  • Sample

    220301-wt691sbah7

  • MD5

    2e491c60d790fd786e4fbdf90b373c59

  • SHA1

    8a5d5c2982020d1427b16c0822234aac98f035cc

  • SHA256

    cc3374a948c98c5be192fd7318b405fe41816e6c372751773ca7b1c9d0d6360e

  • SHA512

    a1170294273ec32fa1af9ea039dd9f997e764170eed5e5ab629344b63c2aff7941f8635bff3c23b566902f13c69c739bd4ae977cf9fc2f51b3354133b0b664df

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/942463554903236658/eGpoLSgLok8IhLx5vkiAmEckByCTxphzQ8sOJ-zvhUCc7hcVLCWAgc-5IQbCbcls-nn2

Targets

    • Target

      cc3374a948c98c5be192fd7318b405fe41816e6c372751773ca7b1c9d0d6360e.bin

    • Size

      303KB

    • MD5

      2e491c60d790fd786e4fbdf90b373c59

    • SHA1

      8a5d5c2982020d1427b16c0822234aac98f035cc

    • SHA256

      cc3374a948c98c5be192fd7318b405fe41816e6c372751773ca7b1c9d0d6360e

    • SHA512

      a1170294273ec32fa1af9ea039dd9f997e764170eed5e5ab629344b63c2aff7941f8635bff3c23b566902f13c69c739bd4ae977cf9fc2f51b3354133b0b664df

    Score
    10/10
    44caliberspywarestealer

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks