General

  • Target

    c3adcc3845887d661c5b1c83d2056f54

  • Size

    252KB

  • Sample

    240312-slryksea33

  • MD5

    c3adcc3845887d661c5b1c83d2056f54

  • SHA1

    b9ee2a5e9c48e77662b3f1b72bf1c0c91a52acbf

  • SHA256

    ca3c3aa03d433a067b297390a09bece2fd350813639e54dd97db18804e905a4c

  • SHA512

    737d87e7cd1511f848bf46670926b418f3c6e285323ca9626073db5df787cfe762c5dd0fd96f67602b0e60f7f599a8e91ce2223b27bb9dda454ec72d41c5dcff

  • SSDEEP

    3072:p77eMqu+6ju4ulnpsXMZ4jB/l3jAQ9iGbENKAZEi4Zr4Ekz1eaMjAmectmM3hI/5:ZeMu6A/ejB/hA2iGwREigc1z1eRbp5

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/879667505914843196/FSgcks9wUtWqypXECLPBNeh9fcBnYszBQiHHlUp3kPibjIkzQVY427-k4YdajckQ8QQK

Targets

    • Target

      c3adcc3845887d661c5b1c83d2056f54

    • Size

      252KB

    • MD5

      c3adcc3845887d661c5b1c83d2056f54

    • SHA1

      b9ee2a5e9c48e77662b3f1b72bf1c0c91a52acbf

    • SHA256

      ca3c3aa03d433a067b297390a09bece2fd350813639e54dd97db18804e905a4c

    • SHA512

      737d87e7cd1511f848bf46670926b418f3c6e285323ca9626073db5df787cfe762c5dd0fd96f67602b0e60f7f599a8e91ce2223b27bb9dda454ec72d41c5dcff

    • SSDEEP

      3072:p77eMqu+6ju4ulnpsXMZ4jB/l3jAQ9iGbENKAZEi4Zr4Ekz1eaMjAmectmM3hI/5:ZeMu6A/ejB/hA2iGwREigc1z1eRbp5

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks