44caliber | expensivecrak3[.]0[.]rar

General

Target
expensivecrak3.0.rar
Size 111KB
Sample231201-trnnsadf35
SHA256 3bf062d997913c12bcee479623af730d98be59993a704abbddffed5e7fa604d5
MD5 ba1e87a7123e7d1a851872a96c155bd4
SHA1 a4a9b27c7cad5c47132651c29a05d35ac91a3888
SHA512 e77ec21fb70afbd3fc51ce49f0b86d3c1e46f040a46cdf547711c376d5db23c23fe4ee0afa89a414eae908f06b73d6aa068dcf4d00fca510f1b1b6e9a9fd09fb
SSDEEP 3072:8fqUt1aA1RmJYxvC0iCFJqLloiMpYrdi68:8flD1RmyvD5fkloieP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1106246820465754193/PhLXU_8QVd9PKEsWp1wYfiuAgulXvdo3vNtxDX_F2rZvdBoVeobiSd4lhoRwXHxlyOwF

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/deadsense.exe

File Explorer

expensivecrak3.0.rar

.zip 111KB
deadsense.exe

.exe 274KB

expensivecrak3.0.rar

SHA256 3bf062d997913c12bcee479623af730d98be59993a704abbddffed5e7fa604d5
MD5 ba1e87a7123e7d1a851872a96c155bd4
SHA1 a4a9b27c7cad5c47132651c29a05d35ac91a3888
SHA512 e77ec21fb70afbd3fc51ce49f0b86d3c1e46f040a46cdf547711c376d5db23c23fe4ee0afa89a414eae908f06b73d6aa068dcf4d00fca510f1b1b6e9a9fd09fb
SSDEEP 3072:8fqUt1aA1RmJYxvC0iCFJqLloiMpYrdi68:8flD1RmyvD5fkloieP
MD5 SHA1 SHA512 SSDEEP

Password

123

deadsense.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a35b29189e4ea69890b73e5c64a26a3badc61b9e2084ddfa1a959bc6241ff1dd
MD5 3052e30d962a23b4e3766f025b8d6c21
SHA1 97bec7796489888ad6aacdc5f3281f88c0287cf1
SHA512 cf9a993eeba2440a6bacedff874a3b84e7112e6f11dfebc4d591380b462bdb1a247099290c5fa448d0431daa7ec55080db6d23219da1c10ca2a168ade5e4b680
SSDEEP 6144:Zf+BLtABPDWlR1ZroWT0Ilb5wqlYeJClA1D0Ne9:4luK0Ilb5/lYe11Dx9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

0

Major OS version

4

Entry point

276762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

expensivecrak3.0.rar

deadsense.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

expensivecrak3.0.rar

deadsense.exe

mscoree

dotnet