General

  • Target

    Insidious.exe

  • Size

    274KB

  • Sample

    231227-q3r9kaeba9

  • MD5

    2080c22a4df9e8c9e476556e63206599

  • SHA1

    5c5393339234228798164654314f0d8de5ce04ca

  • SHA256

    738a089b363e1b9f43149def5ae5b136bc9009286e4304e09230e60d0d41e6d0

  • SHA512

    d07064ad61a4fe469e8fd21ae3a65d5c64e47e4bb73336aab9eaad984a10888e9b4e88d7fa4f442c46a01ccf7910ca5f6df6e278e05680fe6521ad7adebd25b7

  • SSDEEP

    6144:Xf+BLtABPD34JMDSOxIWM8VzZdafTyMlI1D0doN:z4GiWM8Vzdh1DpN

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1189420678399676496/Cv6q-pjb2lOltckEXX8PZeIwdjaBhHevzpPlWHccy6VfWacxjuWV_ETooqcyrrEG3G0e

Targets

    • Target

      Insidious.exe

    • Size

      274KB

    • MD5

      2080c22a4df9e8c9e476556e63206599

    • SHA1

      5c5393339234228798164654314f0d8de5ce04ca

    • SHA256

      738a089b363e1b9f43149def5ae5b136bc9009286e4304e09230e60d0d41e6d0

    • SHA512

      d07064ad61a4fe469e8fd21ae3a65d5c64e47e4bb73336aab9eaad984a10888e9b4e88d7fa4f442c46a01ccf7910ca5f6df6e278e05680fe6521ad7adebd25b7

    • SSDEEP

      6144:Xf+BLtABPD34JMDSOxIWM8VzZdafTyMlI1D0doN:z4GiWM8Vzdh1DpN

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks