Overview

overview

10

Static

static

7

7785a72cf5...e2.exe

windows7-x64

10

7785a72cf5...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7785a72cf5de9918ebd92440ee3713e2

  • Size

    1001KB

  • Sample

    240126-q2vy3afab5

  • MD5

    7785a72cf5de9918ebd92440ee3713e2

  • SHA1

    51d6a04a1ae80abd4c121980cf13827d70a8bbff

  • SHA256

    8a513917248c59b0b1f2b4789443ea0b0fedaec8b095045eced81dc85c83e53b

  • SHA512

    a4dfc424876a741aa5764d45a3b1152edb3dbeb9fad12640ade0b3188ecde6cdf53df7c150454738f7e277072cfbc7fc8da40883bb3ecfc0d6c9e457b1d44e3e

  • SSDEEP

    24576:diSvJKfOVWGK+PvpWuiWIp5V63X3EN8TPmqv:dKfIG+PvpWy3dTPmq

Score
10/10
44caliberevasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/864993390039138344/KcIraJ14D-c_gxt8b62QhfVu_PGaoIgxX5A9WLR2Iw9WLUoF8VGIsnRR969mXFvP0Unf

Targets

    • Target

      7785a72cf5de9918ebd92440ee3713e2

    • Size

      1001KB

    • MD5

      7785a72cf5de9918ebd92440ee3713e2

    • SHA1

      51d6a04a1ae80abd4c121980cf13827d70a8bbff

    • SHA256

      8a513917248c59b0b1f2b4789443ea0b0fedaec8b095045eced81dc85c83e53b

    • SHA512

      a4dfc424876a741aa5764d45a3b1152edb3dbeb9fad12640ade0b3188ecde6cdf53df7c150454738f7e277072cfbc7fc8da40883bb3ecfc0d6c9e457b1d44e3e

    • SSDEEP

      24576:diSvJKfOVWGK+PvpWuiWIp5V63X3EN8TPmqv:dKfIG+PvpWy3dTPmq

    Score
    10/10
    44caliberevasionpersistencespywarestealertrojanupx

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

3
T1112

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks