General

  • Target

    224e8b219e855f118375d487e6ac15f0

  • Size

    252KB

  • Sample

    231231-a86q5scbb9

  • MD5

    224e8b219e855f118375d487e6ac15f0

  • SHA1

    02397f0e277508ce202d7f90b325c4ed7298eeb4

  • SHA256

    80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371

  • SHA512

    c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f

  • SSDEEP

    3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/869635461541429258/hxEYazB2m_bqWOWdlnRrBOnLi8waabSchbnYiXPHDudSBlAEOry51hz3i902VgDh1LGm

Targets

    • Target

      224e8b219e855f118375d487e6ac15f0

    • Size

      252KB

    • MD5

      224e8b219e855f118375d487e6ac15f0

    • SHA1

      02397f0e277508ce202d7f90b325c4ed7298eeb4

    • SHA256

      80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371

    • SHA512

      c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f

    • SSDEEP

      3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks