General

  • Target

    f33ce8a56f6e635e42844edbd03569120d56c28dbb902a87316687667ff6c6b9.bin

  • Size

    252KB

  • Sample

    220301-wvc3kacffp

  • MD5

    727f871c6a9151b9c7edd435b2e0a4a0

  • SHA1

    2a857cbe7c20a04cb668045d8f2bb0241ec7a4ce

  • SHA256

    f33ce8a56f6e635e42844edbd03569120d56c28dbb902a87316687667ff6c6b9

  • SHA512

    f95ce1f9b33d38c3ac4e66ad945673c35aa730dacb0bc9426367f28241a79daa9a51ad145526f6aed8034972168ed55cf4e432e1a257fc9a72ca913cb93cb6d4

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/941986689709137930/LKCHnOiVuh0n3jE7BdB9bpDlzvK0fX8pEXx58iWJcCPcde_CC8MD15H7kSkIFx040A5u

Targets

    • Target

      f33ce8a56f6e635e42844edbd03569120d56c28dbb902a87316687667ff6c6b9.bin

    • Size

      252KB

    • MD5

      727f871c6a9151b9c7edd435b2e0a4a0

    • SHA1

      2a857cbe7c20a04cb668045d8f2bb0241ec7a4ce

    • SHA256

      f33ce8a56f6e635e42844edbd03569120d56c28dbb902a87316687667ff6c6b9

    • SHA512

      f95ce1f9b33d38c3ac4e66ad945673c35aa730dacb0bc9426367f28241a79daa9a51ad145526f6aed8034972168ed55cf4e432e1a257fc9a72ca913cb93cb6d4

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks