Overview

overview

10

Static

static

10

224e8b219e...f0.exe

windows7-x64

10

224e8b219e...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    224e8b219e855f118375d487e6ac15f0

  • Size

    252KB

  • Sample

    231231-a86q5scbb9

  • MD5

    224e8b219e855f118375d487e6ac15f0

  • SHA1

    02397f0e277508ce202d7f90b325c4ed7298eeb4

  • SHA256

    80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371

  • SHA512

    c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f

  • SSDEEP

    3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/869635461541429258/hxEYazB2m_bqWOWdlnRrBOnLi8waabSchbnYiXPHDudSBlAEOry51hz3i902VgDh1LGm

Targets

    • Target

      224e8b219e855f118375d487e6ac15f0

    • Size

      252KB

    • MD5

      224e8b219e855f118375d487e6ac15f0

    • SHA1

      02397f0e277508ce202d7f90b325c4ed7298eeb4

    • SHA256

      80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371

    • SHA512

      c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f

    • SSDEEP

      3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd

    Score
    10/10
    44caliberspywarestealer

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks