44caliber | d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

Sharing

Copy URL Twitter E-mail

General

Target
d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae
Size 303KB
Sample240409-c4xc1sfe71
SHA256 d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae
MD5 c763e936df8e54ad67dbfa4b3bd3c0bc
SHA1 beaaa7a141823c64fb245f19ac3c2251fef900d1
SHA512 4eafdd8a3f3f8041d51ea1019a1695f46781c5d47be7d1142a043c4cf9531a07343583f1c148db9277341a82aa1380bf2df2c866382ee8b9bfef611f0c78c5c1
SSDEEP 6144:iBcT6MDdbICydeBP0+KUmylpnY6rmA1D0RWE:iBKM+KUmapY41DbE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1226160357496721500/M8J7D5k1hO1RyahDiTtwdkk4Fvbpx4urcIZZllG8IAXSc4eGIg2m6G4UbF_cjPMvvv0D

Signatures

44caliber family
44caliber

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing Discord tokens regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing credit card regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

File Explorer

d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

.exe 303KB

d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae
MD5 c763e936df8e54ad67dbfa4b3bd3c0bc
SHA1 beaaa7a141823c64fb245f19ac3c2251fef900d1
SHA512 4eafdd8a3f3f8041d51ea1019a1695f46781c5d47be7d1142a043c4cf9531a07343583f1c148db9277341a82aa1380bf2df2c866382ee8b9bfef611f0c78c5c1
SSDEEP 6144:iBcT6MDdbICydeBP0+KUmylpnY6rmA1D0RWE:iBKM+KUmapY41DbE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables Discord URL observed in first stage droppers
Detects executables referencing Discord tokens regular expressions
Detects executables referencing credit card regular expressions
Detects executables referencing many VPN software clients. Observed in infosteslers
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\iclub\Desktop\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb

d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

mscoree

dotnet