General

  • Target

    37ac48c6a31ec8e83e4b92f03e729917

  • Size

    274KB

  • Sample

    231231-qj5esahfgj

  • MD5

    37ac48c6a31ec8e83e4b92f03e729917

  • SHA1

    ae3fb437257f048177223eff1df8f4a009aa6545

  • SHA256

    be163731cfe152309f2f36332968aa275edef44ede0544d9fa37d26ce530cb77

  • SHA512

    9209bf598ee9caa514700921cea8a2e788ce76eb03bf7acb0f21c462859974792d6bcf41d57a0578db90d79a86355556ed87717ee15caf4a5019448fe8d88c30

  • SSDEEP

    6144:Gf+BLtABPD9NF/DVGK7zeNL+dN41V6GIeyXyRA1D0kj2:wNKK7zeNL2Y69eyXX1DL2

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/859014405580783637/J-rOLcLQORAp4rSIpre0H46Lhmzd8QK1hgRFNA4mqYSEz6dtJRq9HsK-id725NgqZTvK

Targets

    • Target

      37ac48c6a31ec8e83e4b92f03e729917

    • Size

      274KB

    • MD5

      37ac48c6a31ec8e83e4b92f03e729917

    • SHA1

      ae3fb437257f048177223eff1df8f4a009aa6545

    • SHA256

      be163731cfe152309f2f36332968aa275edef44ede0544d9fa37d26ce530cb77

    • SHA512

      9209bf598ee9caa514700921cea8a2e788ce76eb03bf7acb0f21c462859974792d6bcf41d57a0578db90d79a86355556ed87717ee15caf4a5019448fe8d88c30

    • SSDEEP

      6144:Gf+BLtABPD9NF/DVGK7zeNL+dN41V6GIeyXyRA1D0kj2:wNKK7zeNL2Y69eyXX1DL2

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks