General

  • Target

    f9484530eef5af91375b16ad1312dd29.bin

  • Size

    122KB

  • Sample

    230413-cpr5ragf95

  • MD5

    9b91c1a6fbc54de69b22a2161eecd9a4

  • SHA1

    f1fcfa77bffd7d3e77f8ccc0175ed4ef39f40723

  • SHA256

    16163da307efedbc8a540ec1c6b643d2b40587494086af3dead37127f4966987

  • SHA512

    2788dfbb57881698dce51c5d7c1e23d356d2e9aea3ac58c193d98866684166c13b26e56a71c36991e5c643c6c8ca569b82e552f4ae651950b397d4ad96d4b7e0

  • SSDEEP

    3072:sl0xq5FmcY0LBWjHXvmA0jfQ3gPysSmkTz+kgagG:sh50d0L+3vH0jfcuysSmkOkgab

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1095429503737675886/XSOjpaYnkVlwzQqXu4kvtIMhmZQVCMFwUVjdoKgnPXh4ER5XWIZ-0wzCDA36bKxszrIs

Targets

    • Target

      29e74d69dbe506f07c91cd245427379aebc67b1c24dafc2cd0bde49ed6fd5cee.exe

    • Size

      303KB

    • MD5

      f9484530eef5af91375b16ad1312dd29

    • SHA1

      0bf165ea23cf50314f63efc6b1fe70dfc513fc9a

    • SHA256

      29e74d69dbe506f07c91cd245427379aebc67b1c24dafc2cd0bde49ed6fd5cee

    • SHA512

      6683fb523fed816538c763859cbad5805b03334521d4ca83be1fff30d8cb84bc836ae1612d677accb984000d45644bfcadf9618e63ede98e2643b5702d93c0ba

    • SSDEEP

      6144:n+AC6MDdbICydeBWJaDNnqrMtt1KLIbldMWA1D0Usje:n+vzDNnqrqYd1Dkje

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks