Resubmissions

09/04/2023, 16:27

230409-tx7c3sdf7t1

09/04/2023, 16:23

230409-tv84wsdf6z10

General

  • Target
    https://disk.yandex.ru/d/Tf0EJKzaNJx0sQ
  • Sample230409-tv84wsdf6z

Malware Config

Extracted

Family
  • 44caliber

C2
  • https://discordapp.com/api/webhooks/1094353602480451655/iwXRe5GczCwBpNJy71UEaTWEPehskOT4c6LbuhNojAGvyX9mB0ftCXsTMjEdVh2ZaYw5

Targets

    • Target
      https://disk.yandex.ru/d/Tf0EJKzaNJx0sQ
    • 44Caliber

      An open source infostealer written in C#.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks