General

  • Target

    7zip.exe

  • Size

    303KB

  • Sample

    230411-yd3yrsgd9v

  • MD5

    f9484530eef5af91375b16ad1312dd29

  • SHA1

    0bf165ea23cf50314f63efc6b1fe70dfc513fc9a

  • SHA256

    29e74d69dbe506f07c91cd245427379aebc67b1c24dafc2cd0bde49ed6fd5cee

  • SHA512

    6683fb523fed816538c763859cbad5805b03334521d4ca83be1fff30d8cb84bc836ae1612d677accb984000d45644bfcadf9618e63ede98e2643b5702d93c0ba

  • SSDEEP

    6144:n+AC6MDdbICydeBWJaDNnqrMtt1KLIbldMWA1D0Usje:n+vzDNnqrqYd1Dkje

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1095429503737675886/XSOjpaYnkVlwzQqXu4kvtIMhmZQVCMFwUVjdoKgnPXh4ER5XWIZ-0wzCDA36bKxszrIs

Targets

    • Target

      7zip.exe

    • Size

      303KB

    • MD5

      f9484530eef5af91375b16ad1312dd29

    • SHA1

      0bf165ea23cf50314f63efc6b1fe70dfc513fc9a

    • SHA256

      29e74d69dbe506f07c91cd245427379aebc67b1c24dafc2cd0bde49ed6fd5cee

    • SHA512

      6683fb523fed816538c763859cbad5805b03334521d4ca83be1fff30d8cb84bc836ae1612d677accb984000d45644bfcadf9618e63ede98e2643b5702d93c0ba

    • SSDEEP

      6144:n+AC6MDdbICydeBWJaDNnqrMtt1KLIbldMWA1D0Usje:n+vzDNnqrqYd1Dkje

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks