Overview

overview

10

Static

static

10

UHAP Sorgu.exe

windows7-x64

10

UHAP Sorgu.exe

windows10-1703-x64

10

UHAP Sorgu.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UHAP Sorgu.bin.zip

  • Size

    108KB

  • Sample

    220920-1vr9psaaem

  • MD5

    be524c443f1927b7ba0539562cee99db

  • SHA1

    aa2c1a3d2b11a32204d850f0b1766a9e1ad58d59

  • SHA256

    01ca7280315956762eb4c6e2c727820779e4fd6bdcd3b6e8a2ecca46267b20c1

  • SHA512

    d92a33e5d9c5562e5246b348ac7a8ab1b321c17bfd94ff98e2f72e5940860515a49df01fd9d798f7f80296b6e8f173022b08e9bd11837432e2db495ae561d0a0

  • SSDEEP

    3072:Zbiac03qztBofID4q4V/htvkqATfa0tP/dEvkaslaTyZ:inF4nVJtcBTf7t3dAuSs

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/922935347015462933/U9oJsXDPRrEd39o5K-4lVEYCqki7VlOAgiWIlgpKTFSm1UWAneR5bQBsRr3zcmw4JPEL

Targets

    • Target

      UHAP Sorgu.bin

    • Size

      274KB

    • MD5

      918437b1fb7cb9007f0d439396cc392c

    • SHA1

      1889c245e9eb55889f40f42efdd2315c40ce414e

    • SHA256

      05192de4246ba6acd7799d2137b4a1f1ec5520d129d68cec2b2976b2c1bea90e

    • SHA512

      b2df6e41d0376f4f7c8b2144aec63f5dd55f82e8acc8d25b318ffb443bf32de637ae6c1c0ecc00278bef9d59c2fca515cead5690c9b19669adefdbc6205aa0ef

    • SSDEEP

      6144:Yf+BLtABPDlgj1xw1eO5rbEMzpgUsY3hiGUClYeJilA1D0c3/:1161eO5rbrHsY3hiG7lYeV1Df/

    Score
    10/10
    44caliberspywarestealer

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks