General

  • Target

    Insidious.bin

  • Size

    274KB

  • Sample

    220708-lwmchsbean

  • MD5

    2a045edff73b33791ebcb7077725b650

  • SHA1

    15dfbffb6876a0f78f925f3bd407352af7c0b070

  • SHA256

    47c42c1aa79425aa022efc0650e8465185b1d2694d21898f287eae5efed5ce15

  • SHA512

    398eef4effcb8abf821f82966e98c2790b8c0ea76c5f419e739fa6fbd52885ebff1de77da22eeb23b758b3e5219cbff317667d2a555a0cf9f1cba3f633794bde

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/993771742373892207/G2243YWyGbuATWA0961Hf1DMkEC_PyBy0ABLMu4YRxsTN5o8A1jVzAeRnglWOJNXEd8n

Targets

    • Target

      Insidious.bin

    • Size

      274KB

    • MD5

      2a045edff73b33791ebcb7077725b650

    • SHA1

      15dfbffb6876a0f78f925f3bd407352af7c0b070

    • SHA256

      47c42c1aa79425aa022efc0650e8465185b1d2694d21898f287eae5efed5ce15

    • SHA512

      398eef4effcb8abf821f82966e98c2790b8c0ea76c5f419e739fa6fbd52885ebff1de77da22eeb23b758b3e5219cbff317667d2a555a0cf9f1cba3f633794bde

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks