Overview

overview

10

Static

static

7

914350a00c...50.exe

windows7-x64

10

914350a00c...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    914350a00cb299d2807c459fd950e750

  • Size

    495KB

  • Sample

    240205-g5shnsceb4

  • MD5

    914350a00cb299d2807c459fd950e750

  • SHA1

    8df271a04e4e45e1e6210f1f01b517d71b9236f4

  • SHA256

    228ee56c9ca55a911f1c0789b58050e408d14a7fbc21bb1ef3a41426a2dae840

  • SHA512

    d15f3d2914c28561e4b5f2466f3651e4eba7d175dd76d9232923dccf7d4abf154670991d74c5949c8fe79349808b834ffde8e5833b20ca8d09e955504ad08a06

  • SSDEEP

    6144:dfptJNaTZTXr1u3P55Z9JZ1145i4Hw6a3eOU3gkWtXP6x08lZO8oLCGRcgi6Ov4W:dfpts7hiL9JZ1KB/dDgyHZoLM6zG

Score
10/10
44caliberspywarestealervmprotect

Malware Config

Targets

    • Target

      914350a00cb299d2807c459fd950e750

    • Size

      495KB

    • MD5

      914350a00cb299d2807c459fd950e750

    • SHA1

      8df271a04e4e45e1e6210f1f01b517d71b9236f4

    • SHA256

      228ee56c9ca55a911f1c0789b58050e408d14a7fbc21bb1ef3a41426a2dae840

    • SHA512

      d15f3d2914c28561e4b5f2466f3651e4eba7d175dd76d9232923dccf7d4abf154670991d74c5949c8fe79349808b834ffde8e5833b20ca8d09e955504ad08a06

    • SSDEEP

      6144:dfptJNaTZTXr1u3P55Z9JZ1145i4Hw6a3eOU3gkWtXP6x08lZO8oLCGRcgi6Ov4W:dfpts7hiL9JZ1KB/dDgyHZoLM6zG

    Score
    10/10
    44caliberspywarestealervmprotect

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks