44caliber | 7bbf3544dd40563418fa47d9ff87664d25b7a8539872980b2773cb894812d415 | Triage

Sharing

General

Target

Insidious.exe
Size

303KB
Sample

240414-en91aaha7z
MD5

6942218ff4992c244e5cb08e32389da6
SHA1

2ebda9f22dcf7fa27ef8e93514aebfca4dd9e280
SHA256

7bbf3544dd40563418fa47d9ff87664d25b7a8539872980b2773cb894812d415
SHA512

d06611bd17090280dac2fd4b5421139532b2e72f2d60f58c9356f7ad7c4ed20da97c338d750a884c229960bebbdee85fd10813d09c93265e51cfaa6e58eb692b
SSDEEP

6144:5HXT6MDdbICydeBaWRHMmzKjpIo3Z6TmA1D0d++:5HNTMmzKNIopo1DH+

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1228686341920002129/0p6sR-mgip63EfRKTmq--Jj8WMAZPUBRp65zhN4N5fUZSFKF1Ox_0f7n-d4zUYZyfSyW

Targets

- Target
  
  Insidious.exe
- Size
  
  303KB
- MD5
  
  6942218ff4992c244e5cb08e32389da6
- SHA1
  
  2ebda9f22dcf7fa27ef8e93514aebfca4dd9e280
- SHA256
  
  7bbf3544dd40563418fa47d9ff87664d25b7a8539872980b2773cb894812d415
- SHA512
  
  d06611bd17090280dac2fd4b5421139532b2e72f2d60f58c9356f7ad7c4ed20da97c338d750a884c229960bebbdee85fd10813d09c93265e51cfaa6e58eb692b
- SSDEEP
  
  6144:5HXT6MDdbICydeBaWRHMmzKjpIo3Z6TmA1D0d++:5HNTMmzKNIopo1DH+
Score

10^/10

44caliber spyware stealer
- 44Caliber
  An open source infostealer written in C#.
  stealer 44caliber
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

44caliberspywarestealer