44caliber | Neon v2[.]rar

General

Target
Neon v2.rar
Size 103KB
Sample230712-v2m1nseb79
SHA256 b1e22731feaa39630fdc4ce2f145dee3984d5c8ec57e67d681c2bec7c0c3ebc9
MD5 f38b27745d24cc16c2d3c6e5fe933e7e
SHA1 bfc30c46362584622a863cf153ef8eabeb838c6f
SHA512 a43beb185f76b8503bc8768e8477b827fb2a7faa317fc52de758c43ab82f3484415077450a29596f9c0087a5d637888c8d0514218750fc5f35c0fd777a666ccf
SSDEEP 1536:/vs6Xqj51478GgTnDdwsJ1RDJiXIAD1eAvG5FpvouWfx6s5/GkK1iPzimAuRExbw:XkkgTDdwsJDBLiWQss8uziCRE1A/CM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discordurls 44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/956477791124205569/zhz-iUwTtwf3ND8UdSeoNmdX8X4ElZBSxqhFrwstZ6oV5o-CWZxANYz737UasCARyImg

Signatures

44caliber family
44caliber

Detected executables Discord URL observed in first stage droppers 1 IoCs

DISCORD URLS.

discordurls

resource	yara_rule
static1/unpack001/Neon v2/Neon v2.exe	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Neon v2/Neon v2.exe

File Explorer

Neon v2.rar

.rar 103KB
Neon v2/Neon v2.exe

.exe 274KB

Neon v2.rar

SHA256 b1e22731feaa39630fdc4ce2f145dee3984d5c8ec57e67d681c2bec7c0c3ebc9
MD5 f38b27745d24cc16c2d3c6e5fe933e7e
SHA1 bfc30c46362584622a863cf153ef8eabeb838c6f
SHA512 a43beb185f76b8503bc8768e8477b827fb2a7faa317fc52de758c43ab82f3484415077450a29596f9c0087a5d637888c8d0514218750fc5f35c0fd777a666ccf
SSDEEP 1536:/vs6Xqj51478GgTnDdwsJ1RDJiXIAD1eAvG5FpvouWfx6s5/GkK1iPzimAuRExbw:XkkgTDdwsJDBLiWQss8uziCRE1A/CM
MD5 SHA1 SHA512 SSDEEP

Neon v2/Neon v2.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cd8e9641046306857f3a12009ddf442922e32484696b475175c867e8ff580f3e
MD5 1c135a7b80703354a6d8bac14381447d
SHA1 7562f7ba852f7ff91b6ef10647417bd54ff55c6c
SHA512 b9cad0723b37ee5612e64873ebddf428b4ace6396a2b301d8a19bc8c49c9084021f8c14da37298e262888ad62f6bbf78866bef152bb30fa8df39e60348396864
SSDEEP 6144:hf+BLtABPDOpJTNN6eTSUdZ/pOlYeJqlA1D0Mk+:4pYSSUdZ/olYet1DY+
MD5 SHA1 SHA512 SSDEEP

windows x86

Detected executables Discord URL observed in first stage droppers

DISCORD URLS.

discordurls
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

276770

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Resubmissions

Sharing